3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23

Analysis

user interaction
yes
max time kernel
113s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-es
resource tags

arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VisualCppRedist_AIO_x86_x64.exe
Size 30.1MB
Sample260605-ql9saagw3s
SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
MD5 1a7523d92b573859df4cbe8e75509b9e
SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
TLSH
T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
2928	vcredist_x86.exe
5084	vcredist_x64.exe
3264	vcredist_x86.exe
956	vcredist_x64.exe
3964	VC_redist.x86.exe
4212	VC_redist.x64.exe
2380	vcredist_x64.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1976	vcredist_x86.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
1336	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
5032	vcredist_x64.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4764	MsiExec.exe
4348	MsiExec.exe
4692	MsiExec.exe
2972	VC_redist.x86.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4752	VC_redist.x64.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
4112	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe
2832	MsiExec.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20260605092318.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20260605092318.log\" /uninstall /passive /norestart ignored ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	VC_redist.x64.exe
File opened (read-only)	\??\R:	VC_redist.x64.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	VC_redist.x64.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File created	C:\Windows\system32\atl110.dll	msiexec.exe
File created	C:\Windows\system32\msvcp110.dll	msiexec.exe
File created	C:\Windows\system32\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File created	C:\Windows\system32\mfc110u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\dd_vcredist_x86_000_vcRuntimeMinimum_x86.log	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File created	C:\Windows\system32\mfc100chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc120cht.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc100rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc100deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc100enu.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File created	C:\Windows\system32\mfc120u.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc120jpn.dll	msiexec.exe

Drops file in Program Files directory 47 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100esn_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092349920.1\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD087116377566389.TMP	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260605092359842.1	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c5e4.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFB103B53344DF6B6.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092416483.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_1583ac57.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092419467.2\9.0.30729.7523.policy	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8504456F797CCC94.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA75BBC3CA6D2BBC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF86C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE820.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE51.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA4A073A2683C46BF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF154.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF737CACD9E22CBEE.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092349748.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_76a71f32.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092359811.0\atl90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092359842.1\mfc90cht.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092416467.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952.manifest	msiexec.exe
File created	C:\Windows\Installer\e58c602.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2EAB4686AC730531.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDB38E9F52D74DB00.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8DB834502129F858.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCA2FF6795903C5B7.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092349717.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_d7470ca6.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092359842.2\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_b0616a48.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092359842.1\mfc90kor.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092416483.0\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_1583ac57.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF502.tmp	msiexec.exe
File created	C:\Windows\Installer\e58c5e3.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092419436.1\msvcr90.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7CA0AB6225A32451.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c621.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI88B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7547D90C1C9913E0.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092349780.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI889F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3BBF0B3511B56B15.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092349826.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092349905.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092359842.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_6510b4f1.manifest	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7921CF9D26D97959.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092416436.0\ATL80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092416530.0\mfc80ESP.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260605092419436.0	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100rus_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC54F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E05948354185D95.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c5f3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD96A5D304C54C6FA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB2F949E3A99926F1.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092359842.1\mfc90esn.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092359873.1\9.0.30729.7523.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c5ee.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5B0.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605092419451.0\mfc90rus.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9D3924AF063E5027.TMP	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100jpn_x64	msiexec.exe
File created	C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4808	3264	WerFault.exe	255

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualCppRedist_AIO_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027a96ea556b175d40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027a96ea50000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090027a96ea5000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a27a96ea5000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d27a96ea5000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\48	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\46	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\47	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\45	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\43	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\47	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\45	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\44	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\46	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\43	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1AFA6AFEE83700E31810DF308BB6921D\C3AEB2FCAE628F23AAB933F1E743AB79	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditional_amd64,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C05586832351A613E9FF58906A9EF297	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\FT_VC_Redist_CRT_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2565063 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12\DisplayName = "Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\c1c4f01781cc94c4c8fb1542c0981a2a\VC_Redist	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Version = "167812379"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v12\DisplayName = "Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\Version = "12.0.40664"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B696E639D8C084A389FD43F4AEE41193\D169104D02A37CA349B316935DDB94A0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4396FC35D89A48D31964CFE4FDD36514\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2012\\x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2026\\x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7C9F8B73BF303523781852719CD9C700\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FC00402C7EDE723A94E0F3FD809588F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0DE4DCEAB3A89E14291DB6EE3047CCFA\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D05DA3776EAA1AB4DA105B3A88478C04\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v12\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\AA5D9C68C00F12943B2F6CA09FE28244	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\Version = "201367256"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v11	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\27544B162278FAD4A8FCE847D203CB5C\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.CRT,type="win32",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e005f006a0030002c0059005d007300210053006f00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e006f005d00240051005100780059002b002a0036006100210029004e00490036002c0059004900520000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2012\\x86\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1BAD2218D4DE6763BBA0AC63186945E3\ProductName = "Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D169104D02A37CA349B316935DDB94A0\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONAL_AMD64,V11\DEPENDENTS\{CA67548A-5EBE-413A-B50C-4B9CEB6D66C6}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V12\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36}	vcredist_x86.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
1944	reg.exe
3328	reg.exe
3988	reg.exe
3472	reg.exe
1096	reg.exe
4348	reg.exe
3144	reg.exe
2704	reg.exe
4608	reg.exe
2420	reg.exe
2448	reg.exe
2004	reg.exe
4732	reg.exe
1308	reg.exe
4916	reg.exe
4928	reg.exe
3220	reg.exe
5076	reg.exe
900	reg.exe
4808	reg.exe
3472	reg.exe
4920	reg.exe
840	reg.exe
4484	reg.exe
1968	reg.exe
1880	reg.exe
3400	reg.exe
2100	reg.exe
4056	reg.exe
1280	reg.exe
4112	reg.exe
4000	reg.exe
3792	reg.exe
3404	reg.exe
3408	reg.exe
568	reg.exe
884	reg.exe
4308	reg.exe
676	reg.exe
4340	reg.exe
4724	reg.exe
3988	reg.exe
3688	reg.exe
5088	reg.exe
1816	reg.exe
4284	reg.exe
3888	reg.exe
2928	reg.exe
4312	reg.exe
480	reg.exe
1220	reg.exe
2688	reg.exe
2644	reg.exe
3292	reg.exe
3664	reg.exe
3960	reg.exe
756	reg.exe
1564	reg.exe
2032	reg.exe
1224	reg.exe
2292	reg.exe
4996	reg.exe
4688	reg.exe
1724	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe
3712	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	992	WMIC.exe
Token: SeSecurityPrivilege	992	WMIC.exe
Token: SeTakeOwnershipPrivilege	992	WMIC.exe
Token: SeLoadDriverPrivilege	992	WMIC.exe
Token: SeSystemProfilePrivilege	992	WMIC.exe
Token: SeSystemtimePrivilege	992	WMIC.exe
Token: SeProfSingleProcessPrivilege	992	WMIC.exe
Token: SeIncBasePriorityPrivilege	992	WMIC.exe
Token: SeCreatePagefilePrivilege	992	WMIC.exe
Token: SeBackupPrivilege	992	WMIC.exe
Token: SeRestorePrivilege	992	WMIC.exe
Token: SeShutdownPrivilege	992	WMIC.exe
Token: SeDebugPrivilege	992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	992	WMIC.exe
Token: SeRemoteShutdownPrivilege	992	WMIC.exe
Token: SeUndockPrivilege	992	WMIC.exe
Token: SeManageVolumePrivilege	992	WMIC.exe
Token: 33	992	WMIC.exe
Token: 34	992	WMIC.exe
Token: 35	992	WMIC.exe
Token: 36	992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	992	WMIC.exe
Token: SeSecurityPrivilege	992	WMIC.exe
Token: SeTakeOwnershipPrivilege	992	WMIC.exe
Token: SeLoadDriverPrivilege	992	WMIC.exe
Token: SeSystemProfilePrivilege	992	WMIC.exe
Token: SeSystemtimePrivilege	992	WMIC.exe
Token: SeProfSingleProcessPrivilege	992	WMIC.exe
Token: SeIncBasePriorityPrivilege	992	WMIC.exe
Token: SeCreatePagefilePrivilege	992	WMIC.exe
Token: SeBackupPrivilege	992	WMIC.exe
Token: SeRestorePrivilege	992	WMIC.exe
Token: SeShutdownPrivilege	992	WMIC.exe
Token: SeDebugPrivilege	992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	992	WMIC.exe
Token: SeRemoteShutdownPrivilege	992	WMIC.exe
Token: SeUndockPrivilege	992	WMIC.exe
Token: SeManageVolumePrivilege	992	WMIC.exe
Token: 33	992	WMIC.exe
Token: 34	992	WMIC.exe
Token: 35	992	WMIC.exe
Token: 36	992	WMIC.exe
Token: SeBackupPrivilege	2376	vssvc.exe
Token: SeRestorePrivilege	2376	vssvc.exe
Token: SeAuditPrivilege	2376	vssvc.exe
Token: SeShutdownPrivilege	1036	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	1036	vcredist_x64.exe
Token: SeSecurityPrivilege	3712	msiexec.exe
Token: SeCreateTokenPrivilege	1036	vcredist_x64.exe
Token: SeAssignPrimaryTokenPrivilege	1036	vcredist_x64.exe
Token: SeLockMemoryPrivilege	1036	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	1036	vcredist_x64.exe
Token: SeMachineAccountPrivilege	1036	vcredist_x64.exe
Token: SeTcbPrivilege	1036	vcredist_x64.exe
Token: SeSecurityPrivilege	1036	vcredist_x64.exe
Token: SeTakeOwnershipPrivilege	1036	vcredist_x64.exe
Token: SeLoadDriverPrivilege	1036	vcredist_x64.exe
Token: SeSystemProfilePrivilege	1036	vcredist_x64.exe
Token: SeSystemtimePrivilege	1036	vcredist_x64.exe
Token: SeProfSingleProcessPrivilege	1036	vcredist_x64.exe
Token: SeIncBasePriorityPrivilege	1036	vcredist_x64.exe
Token: SeCreatePagefilePrivilege	1036	vcredist_x64.exe
Token: SeCreatePermanentPrivilege	1036	vcredist_x64.exe
Token: SeBackupPrivilege	1036	vcredist_x64.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2432	VisualCppRedist_AIO_x86_x64.exe
2928	vcredist_x86.exe
5084	vcredist_x64.exe
3264	vcredist_x86.exe
956	vcredist_x64.exe
3964	VC_redist.x86.exe
4212	VC_redist.x64.exe
2380	vcredist_x64.exe
864	msiexec.exe
864	msiexec.exe
3804	msiexec.exe
1976	vcredist_x86.exe
5032	vcredist_x64.exe
3804	msiexec.exe
1664	msiexec.exe
1664	msiexec.exe
4768	msiexec.exe
4768	msiexec.exe
2972	VC_redist.x86.exe
1680	msiexec.exe
1680	msiexec.exe
908	msiexec.exe
4752	VC_redist.x64.exe
908	msiexec.exe
768	msiexec.exe
768	msiexec.exe
1328	msiexec.exe
1328	msiexec.exe
3400	msiexec.exe
3400	msiexec.exe
1420	msiexec.exe
1420	msiexec.exe
3408	msiexec.exe
3408	msiexec.exe
1888	msiexec.exe
1888	msiexec.exe
1256	msiexec.exe
1256	msiexec.exe
4468	msiexec.exe
4468	msiexec.exe
4476	msiexec.exe
4476	msiexec.exe
3864	msiexec.exe
3864	msiexec.exe
2276	msiexec.exe
2276	msiexec.exe
4056	msiexec.exe
4056	msiexec.exe
3336	msiexec.exe
3336	msiexec.exe
4916	msiexec.exe
4916	msiexec.exe
2808	msiexec.exe
2808	msiexec.exe
2212	msiexec.exe
2212	msiexec.exe
1948	msiexec.exe
1948	msiexec.exe
1232	msiexec.exe
1232	msiexec.exe
3552	msiexec.exe
3552	msiexec.exe
1508	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4292	2432	VisualCppRedist_AIO_x86_x64.exe	80
PID 4292 wrote to memory of 3360	4292	cmd.exe	82
PID 3360 wrote to memory of 1032	3360	cmd.exe	83
PID 4292 wrote to memory of 4140	4292	cmd.exe	84
PID 4292 wrote to memory of 1524	4292	cmd.exe	85
PID 4292 wrote to memory of 3552	4292	cmd.exe	86
PID 4292 wrote to memory of 3192	4292	cmd.exe	87
PID 4292 wrote to memory of 992	4292	cmd.exe	88
PID 4292 wrote to memory of 5024	4292	cmd.exe	89
PID 4292 wrote to memory of 3236	4292	cmd.exe	91
PID 3236 wrote to memory of 3476	3236	cmd.exe	92
PID 4292 wrote to memory of 5068	4292	cmd.exe	93
PID 5068 wrote to memory of 2272	5068	cmd.exe	94
PID 4292 wrote to memory of 624	4292	cmd.exe	95
PID 624 wrote to memory of 2032	624	cmd.exe	96
PID 4292 wrote to memory of 4024	4292	cmd.exe	97
PID 4292 wrote to memory of 2040	4292	cmd.exe	98
PID 4292 wrote to memory of 4692	4292	cmd.exe	99
PID 4292 wrote to memory of 2384	4292	cmd.exe	100
PID 4292 wrote to memory of 4028	4292	cmd.exe	101
PID 4028 wrote to memory of 3264	4028	cmd.exe	102
PID 4292 wrote to memory of 232	4292	cmd.exe	103
PID 4292 wrote to memory of 2268	4292	cmd.exe	104
PID 2268 wrote to memory of 4980	2268	cmd.exe	105
PID 4292 wrote to memory of 3040	4292	cmd.exe	106
PID 4292 wrote to memory of 4164	4292	cmd.exe	107
PID 4164 wrote to memory of 2312	4164	cmd.exe	108
PID 4292 wrote to memory of 1876	4292	cmd.exe	109
PID 4292 wrote to memory of 2396	4292	cmd.exe	110
PID 2396 wrote to memory of 2736	2396	cmd.exe	111
PID 4292 wrote to memory of 3216	4292	cmd.exe	112
PID 4292 wrote to memory of 4856	4292	cmd.exe	113
PID 4292 wrote to memory of 5056	4292	cmd.exe	114
PID 4292 wrote to memory of 1792	4292	cmd.exe	115
PID 4292 wrote to memory of 3688	4292	cmd.exe	116
PID 4292 wrote to memory of 484	4292	cmd.exe	117
PID 4292 wrote to memory of 3992	4292	cmd.exe	118
PID 4292 wrote to memory of 3732	4292	cmd.exe	119
PID 4292 wrote to memory of 2072	4292	cmd.exe	120
PID 4292 wrote to memory of 2804	4292	cmd.exe	121
PID 4292 wrote to memory of 2292	4292	cmd.exe	122
PID 4292 wrote to memory of 3664	4292	cmd.exe	123
PID 4292 wrote to memory of 2828	4292	cmd.exe	124
PID 4292 wrote to memory of 4736	4292	cmd.exe	125
PID 4292 wrote to memory of 2316	4292	cmd.exe	126
PID 4292 wrote to memory of 3832	4292	cmd.exe	127
PID 4292 wrote to memory of 3220	4292	cmd.exe	128
PID 4292 wrote to memory of 3472	4292	cmd.exe	129
PID 4292 wrote to memory of 1944	4292	cmd.exe	130
PID 4292 wrote to memory of 4996	4292	cmd.exe	131
PID 4292 wrote to memory of 3960	4292	cmd.exe	132
PID 4292 wrote to memory of 3884	4292	cmd.exe	133
PID 4292 wrote to memory of 4068	4292	cmd.exe	134
PID 4292 wrote to memory of 3728	4292	cmd.exe	135
PID 4292 wrote to memory of 3272	4292	cmd.exe	136
PID 4292 wrote to memory of 2928	4292	cmd.exe	137
PID 4292 wrote to memory of 5096	4292	cmd.exe	138
PID 4292 wrote to memory of 3904	4292	cmd.exe	139
PID 4292 wrote to memory of 3520	4292	cmd.exe	140
PID 4292 wrote to memory of 2496	4292	cmd.exe	141
PID 4292 wrote to memory of 4112	4292	cmd.exe	142
PID 4292 wrote to memory of 3328	4292	cmd.exe	143
PID 4292 wrote to memory of 4548	4292	cmd.exe	144
PID 4292 wrote to memory of 4224	4292	cmd.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
"C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:1032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4140
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Windows\system32\reg.exe
    reg.exe query "HKU\S-1-5-19"
    3⤵
    PID:3192
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:3476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:2032
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:4024
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:4692
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - System Location Discovery: System Language Discovery
    PID:232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      PID:4980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 50.35719.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4856
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:1792
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:484
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3732
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:2072
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
    3⤵
    PID:2804
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2292
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
    3⤵
    - Modifies registry key
    PID:3664
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:2828
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    PID:4736
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
    3⤵
    PID:2316
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:3832
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3220
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3472
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1944
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4996
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3960
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString
    3⤵
    PID:3884
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    PID:4068
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3728
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3272
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2928
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5096
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3904
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    PID:3520
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2496
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4112
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3328
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4548
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4224
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4312
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2376
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4552
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1880
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3016
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2264
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4340
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1136
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4840
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3400
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2844
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:5076
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3744
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:556
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2004
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3464
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3412
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:756
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1496
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2976
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4724
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2812
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4204
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3292
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2932
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2260
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3796
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2652
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    PID:3248
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2992
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1388
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3164
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1968
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4768
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2832
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    PID:1016
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:432
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1328
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    PID:1100
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4000
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2864
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    PID:3772
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:384
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2380
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3988
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4992
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4496
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4732
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2032
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3764
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2644
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3452
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4572
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3792
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1588
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2212
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    PID:2448
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4212
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4972
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    PID:3512
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:884
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3408
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2100
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:388
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4924
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4348
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4088
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2168
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3688
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2516
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4804
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:900
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3136
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:484
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4808
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1280
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3664
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1308
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3600
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4052
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3472
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1376
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4696
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4056
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3884
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2424
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:768
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{8D007820-B60F-4D2F-9BDC-20E336D06EA2} {E301ABB9-DA05-41EC-99DF-C2A803C3224A} 2036
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2928
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    - Modifies registry key
    PID:480
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{34508581-B53D-4FAA-BF17-EE443516082F} {AAFCC8DB-F7C7-4F9B-9900-C7C0B4CA5AE5} 1036
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5084
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:1220
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4304
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{57820A52-7161-4386-9044-7AD04BAB1441} {AB4A3677-DF63-4D16-9F8D-180F3DE9D78A} 4304
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:3264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 1112
        5⤵
        Program crash
        
        PID:4808
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    PID:3960
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1376
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{67734192-0A57-4413-B286-F342AA37DD16} {5CCB88B1-D525-4F7A-A30B-7366CD3A65C4} 1376
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:956
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    PID:4224
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:3964
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{1B6D925C-8C10-482C-8443-6AE9A795ACAA} {268F6CC8-2C4A-4E2C-9508-9821393A8540} 3964
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4484
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:1280
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:912
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4212
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7781BEB8-ED10-4C5E-B7EC-A98D03F6082D} {C28E481F-61B9-4E89-8388-342874DEC644} 4212
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3320
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    PID:3048
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:1664
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    PID:1844
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:864
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    PID:3760
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    PID:5092
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3804
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    PID:2292
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    PID:3048
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1664
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
    3⤵
    PID:3688
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5088
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4768
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
    3⤵
    - Modifies registry key
    PID:1816
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
    3⤵
    PID:4540
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1564
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4688
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2740
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
    3⤵
    PID:2872
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
    3⤵
    PID:5096
- - C:\Windows\system32\find.exe
    find /i "TRIN_TRIR_SETUP"
    3⤵
    PID:1508
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s
    3⤵
    PID:2448
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1504
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:864
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp140.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp140.dll"
      4⤵
      PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 50.35719.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1908
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4052
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1976
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2220
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:1312
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4112
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4284
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
    3⤵
    PID:4436
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:3024
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1724
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
    3⤵
    - Modifies registry key
    PID:4000
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:4992
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3988
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3404
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4916
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2032
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString
    3⤵
    PID:3108
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4920
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2704
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1136
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4704
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4608
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2352
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2212
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:840
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1096
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4596
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    PID:2604
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3804
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1388
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    PID:228
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1076
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1792
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    PID:1888
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4348
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4044
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    PID:3788
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2072
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:532
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2420
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4496
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4660
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4484
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4984
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5104
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    PID:1816
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4996
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1920
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3408
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:232
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3960
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1224
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4056
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2740
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    PID:5096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2112
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1588
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2448
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1336
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2724
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2688
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4864
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4136
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    PID:5020
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:384
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2828
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:568
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2516
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4736
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:3328
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4928
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:1680
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    PID:1388
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    PID:5056
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:908
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    - Modifies registry key
    PID:884
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} /v UninstallString
    3⤵
    PID:4952
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5} /v UninstallString
    3⤵
    PID:4140
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{662A0088-6FCD-45DD-9EA7-68674058AED5} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:768
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5} /f
    3⤵
    - Modifies registry key
    PID:4308
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1328
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3400
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1420
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3408
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1888
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1256
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4468
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4476
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3864
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2276
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4056
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3336
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4916
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2808
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2212
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1948
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1232
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3552
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1508
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    PID:2808
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:676
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3888
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    PID:644
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb
    3⤵
    PID:3724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2076

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding DA50A8BD2FE57B8FE8D7CEB8AEB6D873
  2⤵
  - Loads dropped DLL
  PID:1336
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding B82D1225BAB1E68EC9743317E3D1C9D2
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E9C971344B74213669B5E805186D1E8
  2⤵
  - Loads dropped DLL
  PID:4348
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6801E17539A099079B1703907E9B4090
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4692
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding C7BCE5B5937E68F5DACD319EF3B8B7C3
  2⤵
  - Loads dropped DLL
  PID:4112
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding ECD0738427B932BA51C8A522ED380DB4
  2⤵
  - Loads dropped DLL
  PID:2832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 20AB72B610A43B78EAD4DC5B2CD74CE6
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1C0B33CE84B38783EEFA9C7DEFD2ECFE
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5D3BB9F6107AC6A1C42E700E5B4AC65E
  2⤵
  PID:4136
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3F261301B0C79C9925F4FDEF6C9278D2
  2⤵
  PID:4984
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AF77D250CAAA5ACDEA3C57BB626EFE2D M Global\MSI0000
  2⤵
  PID:1608
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 04AFE9E5038CAB30CBF3064DF639D128 E Global\MSI0000
  2⤵
  PID:4692
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    PID:2412
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:4836
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FA52B600D4B76D3A6285518B412553D8 E Global\MSI0000
  2⤵
  PID:3996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1464
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2420
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1500
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1680
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2276
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2072
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4968
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3960
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3892
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3384
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:568
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2768
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3332
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1820
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:480
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4336
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4024
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3700
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1136
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4084
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4880
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3992
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2828
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:484
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4520
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4112
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2452
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5056
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3012
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4812
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3052
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4264
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2696
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4952
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4432
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4436
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1256
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:740
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3472
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:440
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:484
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:568
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1320
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2740
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1576
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2276
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1464
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2648
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:644
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2768
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2452
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:5056
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:3780

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092318.log" /uninstall /passive /norestart ignored /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2328
- C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092318.log /uninstall /passive /norestart ignored
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5024
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092318.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{D89E809F-4D38-424D-9CBA-2C02399A8DCE} {689E2558-5805-420C-B610-C111EAD0C3C3} 5024
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2380

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:4088
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092321.log"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  PID:2168
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092321.log" -burn.unelevated BurnPipe.{324F7DD8-BC5A-4F31-991D-476D8D8FC820} {2E610D37-A4FD-4E54-B773-7724F250DEDB} 2168
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3264 -ip 3264
1⤵
PID:3028

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:1752
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092323.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2012
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092323.log" -burn.unelevated BurnPipe.{29A84919-38F8-4AE4-A34A-B905FAC3230B} {EC5C4AAC-8121-4E0E-84A2-1E6E1B12DCA2} 2012
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5032

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:4572
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092325.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1144
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092325.log"
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:2972

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
PID:4684
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092327.log"
  2⤵
  PID:2180
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092327.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4752
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{484070D2-4B43-4DC9-B4BA-2C933B09052D} {454DED15-AF90-40E3-ABB8-358950B1E0E9} 4752
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:2792

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:4764

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\702a12f59f854a28a9e97db6f6f33761 /t 4300 /p 2432
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c4f3.rbs

Path C:\Config.Msi\e58c4f3.rbs
Size 23KB
SHA256 ba17c6a2569077880f5217b059f966977838ac4769e7815a4a0f3829c19bf167
MD5 35790dc8c350973b6783e53c7781e084
SHA1 62be80273740090ec5027f4c480481c69ddb9901
SHA512 b0099251eb7d5e98e316f2a031d0524b57f07e88074ec543204f86a2db99b66ff4dcbdc04b86cec0716e67f232789189048ffe46bbc457351e74938630bac546
SSDEEP 384:CWfRwneHiCRwHeHTqSPjlHtCZYIygytj/fH9jMAo5GRhNerhY0GRjQ94L2XCCW39:CK7ty+CIz
TLSH
T171B20103668496D3C8A66B30DC5B1B683B32D7D99765834B00ECD1344E933CB3F9AA9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c506.rbs

Path C:\Config.Msi\e58c506.rbs
Size 14KB
SHA256 644ae02ffb6168e34c1d1755e003d37bf1b7f9c20204204e6fe3da26d51240f8
MD5 257e91ceb25b1b1ba82dda129a659312
SHA1 0ebd28609ff72e2351e77227c5d4b3aa1362c4f1
SHA512 6c3080fe0f115f361e524cce4ce923eee28b962601b04be92de8e767e8338b398996c3f65315e0f74c224965adbc40c87700ae0edff2dda8c613145c58aba442
SSDEEP 192:p7f9IRgdI/SgqRgvI/SEPc2Eo0Iq01aDJTeowKZeLrP81qAZzajzaMglg+9H:pT9IRzSRbdkSlHKUvjCMgK+9H
TLSH
T1D8622042AA8582D2D9AA2B30DD071B243BB3D3D6C314838B11CC9674DF47BC56FE999D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c50d.rbs

Path C:\Config.Msi\e58c50d.rbs
Size 21KB
SHA256 fc6a90b987fe40f965ae7b55641fa3eaac64554304df555c1333398cb396e284
MD5 6c6c1fafdf050ed2cfe18ab3beadd10d
SHA1 2d966acd132d42af12d7846d4de2184b77c97708
SHA512 6afb56bee18887f57b2b9f19c559bc16adc31e0b2f7b0e80a46befc0e2725f9d192de01d5a09b043a5ba1aec8072920c82a84984adc840630e92f611b62fd10a
SSDEEP 384:7+RPWR1we5esSOMX3Mq8KywUd343F5qgF3ANaapB:7ueGe5erOMX3Mq8Kta343F5qgF3ANaaT
TLSH
T1B3A2DC03B65092D3D8672B30DD6B1B257B76C7EA9311838B04EC92344FA77C62F9658E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c51e.rbs

Path C:\Config.Msi\e58c51e.rbs
Size 22KB
SHA256 5bda2cdc17501e37fc1d0e98593151a089516946639010e65af8d87013e7e0e4
MD5 9d69a39efed0e23f612d6dad7b48d9b3
SHA1 ad00b5655d8e5bd910f1ab87cab6bf665a448729
SHA512 221f3c1ce8ed86a82a2884f760e7b320a009f0aad8175df6ef8f1ac6cfd9737a23667322399b75df11da09e5d9c0fcd64e2f1dca0914187bec40e7e78daa46cf
SSDEEP 384:nfRuRRHNUZUGz5YkrcZqbogvXD7bUpA6NfafcAK7:n5uqQ
TLSH
T187A2BB026644D5E3C86B2B30ED631B693B32D7D69354878700DD90748EA73D72F9DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c52f.rbs

Path C:\Config.Msi\e58c52f.rbs
Size 15KB
SHA256 184d0fb05d1102ef94c15fa3e30fbffa9a223b3494f77d97e1b5c08d78f94c1e
MD5 488e15e043e991ebe899198159c4b2da
SHA1 ed13d1a5bf93229cc10d9e297377ad9ab80393a3
SHA512 0aaa50d396569791bad18a7023da5bcd16d8ab411511caad3197f679757c4ff0f84c9334494c887c3a926360730f3b9617c7fc4deebb9d1c87272689273c265c
SSDEEP 384:nF4R2TX27RR2mX2tR5JZpgBmQ7fpqPfdFRv:nONJ4F
TLSH
T16C7210426A1582E3D8672B30CA0B1BA93F66C7D5D719834B01CD96708F477CA7EDCA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c537.rbs

Path C:\Config.Msi\e58c537.rbs
Size 20KB
SHA256 b8b675d42be9c095f4c0ec557923f06de92686624c2462e024eddee37105199b
MD5 d39a49e1cf1f91a857ed798a9d410ad7
SHA1 d5787ce2a6fe222f999e8e4a7c6f046e5d145ab8
SHA512 a6231b6bda5733fb504b1f266b0b16302200159ab82686197553301a57176b34dc912da949f98b9960f6b7b3263184a70024c0f6cf6fbd26a2b4a0e84eefc6cc
SSDEEP 384:xlRJglRKgFfXMawmn28I1S9HXVZFbLQPOqcOZcGx6WbyBovFft:xLJgKifXMawmn28IA9HXVZFbkPOqcwcY
TLSH
T1DDA2FE43A64895D3D8B62B70DD671BA47B32CBEA9361434B40DC95384F933C23ED968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c548.rbs

Path C:\Config.Msi\e58c548.rbs
Size 17KB
SHA256 075aa255b143bdc8fd7a05554ce68ba21097aec3c8104d73b7e17ac1abedf600
MD5 87c53fb33c51f6d7a07875e5f6602b22
SHA1 70e3f6d1e8ce40cda6af04e83f4dbc23eeaa94ed
SHA512 1da2c1421e8997cb0e34a3451572bfa6c72dd6a671f3b18c4a6875d0ab7b374d9ff2d438f4d80bbfbf620006be0bad888c57ad5b23a7bb69d6d4a417324c2941
SSDEEP 96:xeRp55Rp/NN1WT8Rl6eDd11xQo8RUeDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3d:xqRz1GRb1Hn4Xyin5f7e+nh18X0Ly
TLSH
T1EF82FD42AA4096C3E8662B70DD571B7037B7C7E5A344839B40DC92349F87BD22F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c552.rbs

Path C:\Config.Msi\e58c552.rbs
Size 31KB
SHA256 e33bebfb8e3055bdf06c61edc61ca1ded614d722d6c5df149f343c358efb0fe6
MD5 c0f474cd8389c1475d29fd991f054f31
SHA1 b2f25bb78cff4d369e64d2bee3fa22366d9e6c7a
SHA512 d8ef7d53fbe85c61dee812e1edc39603698c48a84be4e2ea488457bf2ec6b9113ad7edf5ce078bfa4725587985f833c8c85cf9b9ff43a5a6bd5f5f898b8e4213
SSDEEP 384:XW8N88RpceR9Tu8iu8Eu8XcAlRTMV/ZawBV3yFgmkPRu+Ru2S:Xz9lsqVvRIVxDe6PRu+RuJ
TLSH
T1CDE26402F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B40CE90701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c556.rbs

Path C:\Config.Msi\e58c556.rbs
Size 13KB
SHA256 7eafcaf3db18ef26d742382c66d40183e0f0b18acf7bb904873789894c2f3b26
MD5 e4e17489eebf16292370ee41d561dd6f
SHA1 a9277c60bb6c12eec2e3b39ee849ca194a881ed9
SHA512 507406297c4a8f69df5c258479b099a14017457b638ee519fa7afddbc067aea53540af2e85819cd52fad5ba87587c08db381db1ab149b6c82f8dc03b5d631c72
SSDEEP 96:XMNp48xNpM0NN7ztH8RULeDwYx12tH8ROeDwYCj71rR7c7QNpx1FNpLxcNpkFaxN:X1RkYbRWYYaqbzfCgPo6/efl
TLSH
T15852F0036B0586C7DDA62B30DA231B243B73C7EE9354835B21DDE1748E577862E8D98E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c55b.rbs

Path C:\Config.Msi\e58c55b.rbs
Size 49KB
SHA256 3df899c0c2e449504e14f0c0a91a45c86459e85d6c4b83f67fc7a33d5dfbf9f1
MD5 35d41b2c637b60c71975af7d08801456
SHA1 27d3cb589867616897cb273a754d06c3d88f6636
SHA512 959621e8cf600702e7201e980ad82fc9748134ef47e384e583ec67b6150d8371b398917afd1a5b8c8d234246d25cad674a7f57507860f76f1b9349922f16a476
SSDEEP 768:nQiwWVQKRy2Rs2iOD0MMGrLx6J4CfLUmjew2R7VFYRhhTc:JJcho
TLSH
T1CC33EE023354D6D3D6652A30CD030BB57F3BC6E69321866B54ADC1788FA7BCA2E85E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c57f.rbf

Path C:\Config.Msi\e58c57f.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e58c586.rbs

Path C:\Config.Msi\e58c586.rbs
Size 31KB
SHA256 1e7ebea16509eb36a34e1a19de4588aa68f78f76f54aa50f45a45a35de9c5e80
MD5 14c1b958610f8b3c22a2fc70f98635fe
SHA1 47cdec790fa83bb301603fb40020e0869ec6b257
SHA512 f5adf30cd445ede4cdcd3bf5a2e1990e89da81f3a4e38811bbb4ae44c59a8b44a118e34bc7d280b2de4c9b0eec2d37598c4483901c98b32e4a35c72282a07ef0
SSDEEP 768:Ri7nWjEYuxy1SQBYKsAE6HRzY1WY3BYBYFY7YYYpYOlxlQrnr:R1GG
TLSH
T1E4E28207F316E6D2E9493F74C5032B6CBF97D7A6830E064F44DD88A00E66BC62A5538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c58a.rbs

Path C:\Config.Msi\e58c58a.rbs
Size 22KB
SHA256 eed86eb701562cbfe5fb6454f1395fe26070ed7c62d73ab7bb58004f5a534d72
MD5 f83133fb3a5dd5009ae14a6479c3bb7f
SHA1 d5a69d4effb509ef969d1f8f8d96113218d11e70
SHA512 e9a16b030fa2ba600444267822de9bbb191723290152ec3fc06dbd2ffa1ed1bba9a2ee339081ef27a652ee2608f0ea885c00a108be7598d3098034c6d7992e20
SSDEEP 384:RdRuGR0nAYuWoUhUC7xJjrMNYPzIbSf9qq9o0jcBWjxkP:RTnsAYJkmq
TLSH
T1A3A20E43768099E3C86227B1DD671BA93B32D7D99351434B10ECD1388F633C72E9AA9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c59b.rbs

Path C:\Config.Msi\e58c59b.rbs
Size 52KB
SHA256 90f7ffa7df61ff52c817eb67f413ff29521d2e715c0c49de205ac006e8a9bbf9
MD5 099033dc3905161a11c83f6ac62e982d
SHA1 bbfd42858375df6922cd7ceef9b15d329f3b1ffd
SHA512 4982bf7039fb585bc8aad881a4a82900e9b6ef5fd9193ef144740b2dacd86569e5816c053170ec0b3f04331fd05a5b39bd9d2f0a127f8c6c03a80ea3d488ebc6
SSDEEP 384:PlUBRTmLRxt9IO9h4Z9qjSZvPrwtFpCndsTfjUEjlJ9w8fR3KO1R3xJ9ZR3OBR3Y:P62jZEqM7c3BfwFMco
TLSH
T12A3350023680D0C3D56927B2F82B0B94BB36DAA75721029F81DDD57C8E673C66E8DE4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5c2.rbs

Path C:\Config.Msi\e58c5c2.rbs
Size 20KB
SHA256 83b324f2ae5e2140fbd64e666c090264eff64092086d8d7e1d148fdc3ac9850e
MD5 269ade55957352e41791500413cf2590
SHA1 71f88edc93b1be6b2f963badd4830a6bd56ccf17
SHA512 8b31cc73864a88e8a3cb5c28d85c60571b9a052c5cc0da0414c0add4dd16143dba56eb3e88cc41d7225332da5a021f23e8b7b08f08d5059955f3edd62cd902f4
SSDEEP 192:gKRU1kR115dXcFUADIc1f+W+y4+oAkgCdP7:gKRU6R1TeC81f/cqCP7
TLSH
T12692FB42A684C9D3D8766B30CD631B653BB6DBD5A350438B40DC95308F93BCA2F9C69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5db.rbs

Path C:\Config.Msi\e58c5db.rbs
Size 41KB
SHA256 e4860e9a73c138db7dd07904d9bbe13517c013b83294bbc25da143a671b303fa
MD5 ccef16472bce7ce57369601a95143f5b
SHA1 06686d32651853d32b26eaa6a45e9dcb920e9410
SHA512 eca4332453ac48bfbc59510343f4682c7fd155910ff9c15691b49ff37b9e88405b1220e920bf7502e1724e180c5fc322a31c303fabfe394ef107b37a8baf66e6
SSDEEP 768:wfyMuCg21kTx9/DoflxL1JcEYfwNaqNHTK0035:UyMuCg21kTx9/DoflxL1JcEYoUp
TLSH
T1C91350027900C1C3E5762BB1EC2F17847376D6E78B21439F85CDA5349E873CA5E89E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5e2.rbs

Path C:\Config.Msi\e58c5e2.rbs
Size 13KB
SHA256 7d7f82d76cf97d86ec855bf1de9f5abe8372da4330fedf9e559480c86343c3b4
MD5 82ad83a91ccd92745c466942263f5d0e
SHA1 aab755589ceb225542bcacac206f40815e4ffba1
SHA512 bf2c44582a788ff93da42e20333666c4ffe9a1c26ef0e333ebd5db1e77954745a93a7dd3f72a2fba8d22ad4c97b55835212709be894fe4bb1142e1ee2341dceb
SSDEEP 192:c7f40kVOBVxVxVdVwVVSVeVTNherOcTfwCjGiYfvIoziYfvchoI9PEuN7/oLppV:cT45WLLX+VUQT6aAfe9X9UVB/4
TLSH
T1D7522242AA40C1D2E8EA2B30DE4B1B243BB2D3DAC750938B05CD91749F477DA5FD958E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5e7.rbs

Path C:\Config.Msi\e58c5e7.rbs
Size 21KB
SHA256 23ee6e1bd367bef41cc115593fdcaa8f264e48dc500daf24afb684fe2aec63b8
MD5 14f3560c9a2680ed75dd1bf48562e9b3
SHA1 d4e5fc8848a664bfc4b5bbab2244dd636100b006
SHA512 5f01bc3f4c29b75d511de940d4b940a260ce6763a23652992816620275a6e9d67c61ca5d9fa89df31b68be93ef654d8f349762e8a1d167236e3597fba4cf6fd7
SSDEEP 384:cWj/tdt8tVtctsitntTtxtwtstqtFtyttCtwtUt3tsjtdbt8rD85B923fjjtkfHI:cYPKHqhtRbG6M3UCGC9shPqFtGyNH
TLSH
T132A2ED426A40D6D7D8A66B30CD9B1B183376D7D9E7A5934B00CCD1304E833CB6F9A69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5ec.rbs

Path C:\Config.Msi\e58c5ec.rbs
Size 14KB
SHA256 885d5fcb1ccd3aef93e9657899c2e2966ea7513bbabe7bfdb0e445006dceb6e2
MD5 8bf6eae65e734a0cd499da0de529453b
SHA1 eb6f3965752994f4eb8c0cb2342621b14eb90ad7
SHA512 e2675da599453b6f382d3f9b3ec4a0002a7693e10e783e3f12247dc214670d51a91ca4adef8d2ad340081ae93abc4df67d1d42f24f200ad4b71e6121a34c83c0
SSDEEP 192:1yJXuj2IYcw/0FBCW1GAkI4GAkJnFEXENNep6F:1ytuj2IYcwSPoPOh
TLSH
T14A62E042A600C2D3E8AB6B74DE5727183BB5D3DBD391638B08CD91304E437C95F9969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5f1.rbs

Path C:\Config.Msi\e58c5f1.rbs
Size 21KB
SHA256 e91dca5991a1223dc78bb2713ac7b27336a51045181e885051c60074580aa6f6
MD5 b2b39015005ba5afd290e7dcd916193e
SHA1 e285876e2c060dd3c7704cd5f5efb96d0f032075
SHA512 2fc239f51e18f8e31634456e08de19159bb83af5f070b31eb7f223083a8742a7eb5bc25b65c6bbc66d84e2f5b227eac1ee4fcbec501f2fe5609b990d055df75c
SSDEEP 384:1MT8MgXEtmrnb0MM0IE+AfCuS588UkRZ141B5XDcpq:1MT8MgXEtmrnb0MM0Ij2NF
TLSH
T11EA2EF42A640D6C3D8A76B30DE5B1B553735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5f6.rbs

Path C:\Config.Msi\e58c5f6.rbs
Size 18KB
SHA256 946285133aae060a720a2cb2650f80e571c922b4fafdab10c0875c61311ce8a7
MD5 1295d1aab9f05f07d4a55eb9835246fd
SHA1 4cfd1909e6d27385f8b8ef24a9dee8285710beec
SHA512 6a8292d74e7de26ef6497f41c6afd4d266b828cb0c85b734bc3e25567fe324b0fe6a1d7f8c752472eed3f932b15e0af70185a18fe711b17487340da1d3b91475
SSDEEP 192:y9DAoBHRq+M3NinQv7XZDtY1eCM2jfUIVjfUg03ETLNfHOp+:yxAoBHRqF3NinQv7J+LjfVjf7X
TLSH
T13292EB416A40C2A3E9A63B70CD5B1B1937B6D3DA97A1434B41CC80748E837CA6FDE58B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c5fb.rbs

Path C:\Config.Msi\e58c5fb.rbs
Size 21KB
SHA256 a912693de4abaa4c56eb1e9a1fc4f414669e3eed97a4dff871e28ee0b9052dfc
MD5 ecc2e52fe5696f48ee06a7faaeb3deb4
SHA1 9d7e6bd0ca0b5405f3caff2891b26ae15c188a92
SHA512 937cc26ea998f86ac2e798cc42bd9b9395064d0f7b1d067350b4daeefb8dc29b2f33dec708de8d1d4a4fd386ef242db19d24399857198d7cbd9294b002edc7b8
SSDEEP 384:yT6tFYQxkA+pAv9jH4ryInsalckU72eC6PZje4wMw+2Y2sLH:yT6tFYQxkA+pAv9jayIiZz9J2YXLH
TLSH
T15CA2EB017A00D296E4AB2730CD971B287776C3D99361D78B80CDE1348F937D66EED68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c60a.rbs

Path C:\Config.Msi\e58c60a.rbs
Size 41KB
SHA256 73072040b56d600d442acc04064fed18731289b418e128d85c9335a3147a293e
MD5 52c586d8a7ce88c5cccdc3518652477c
SHA1 dd02c27403f8baec3ca3356efe00143a8ea654ef
SHA512 87f8c8b01b479dd208d184d402a1001c0a1e42eec475d806899f069a2313ae1b3a8928d2da61bccf11a79da8786e10ba6239efce62e35b1008be329c51be8c6f
SSDEEP 384:6ravWXI8pxL65YgpiqeHs0wgdKtklYgHrPWdrwJrDr8SroBsQnjnNJoa73diU5i9:6AW4uxO5YgpiqeHs0wgdKtk5Y8lnUjch
TLSH
T11C13F0426600D2C3EAA61A30CE071B757B7AC2E6D715976F14CED0704FC3BC92E99B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c610.rbs

Path C:\Config.Msi\e58c610.rbs
Size 3KB
SHA256 adcf0947b8b3d33cd7a5ebf07cd3f6e4c3b511fb77d8c6416c891648c1cb6733
MD5 9ba24ae0cc1c14cfde6272507ed62b11
SHA1 219de9673a195c7c695d102da45f225708a7f573
SHA512 1e2e2269996735314845a0edcd35cd0a4203fc10acd31655157022119634bb2c73f4e423af3e69eafb2d73aff1426d9983f6f4420cbb5f5ca7d42160383d6496
TLSH
T19F71A9039904D2C2EDE63B70D9571B6537B3C7EA8790938B11CC91704E47BC6AEDA24A
MD5 SHA1 SHA512 TLSH

Submit Download

e58c613.rbs

Path C:\Config.Msi\e58c613.rbs
Size 3KB
SHA256 d0b784a6a7f325939f3a99a0a82e7204edeb3aacde9b5e5a7d0914969dd09a16
MD5 88315b5418f4a56a80ef183da44ac01f
SHA1 1e7e8aac442c9a16a46eb81ad4d56ff417bf8cbb
SHA512 f4017748cd442fe9a345276fef1eee9d06297e02c45b5d32146987da8bb1544366a183ee05685d792c3a70b277955e181a6c9af32f552b422931b72cef586ba4
TLSH
T15C71C043994492D2DCA62B70CA270B6837B7D7DE9750438B458CC1740E877C5AEDB28B
MD5 SHA1 SHA512 TLSH

Submit Download

e58c617.rbs

Path C:\Config.Msi\e58c617.rbs
Size 15KB
SHA256 4d6b76abcd647ef691577567503218c7fdd99eca284c4547b987b6baaf5dea6b
MD5 1a5edea9781d735ddd6d3184325ad006
SHA1 6b966f4c4c5b44a6704b171293828ca8cd8788f0
SHA512 b827abe636b613936a34a98894155060bd082a487cef3d1d1382a7df994b491861ef0cbd8e43b707b1f983f8190f864d44763df4e3ebddb8e60677b6e1d5c3fa
SSDEEP 96:UrXNpU0jNpgbKwNNNNXsjV9NpvHP+HRxWR5OeeNpVZCXzeAzeQKwSU/MeD2gARCW:UrSKzlR5UCb1NAkIgNAkyH/EnwNWepFh
TLSH
T13F621E02A60099C3ECA62B34CA971B583773C7EAD354534B04ECD5749E87BC61F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c61f.rbs

Path C:\Config.Msi\e58c61f.rbs
Size 20KB
SHA256 3ae6a4c2fa2b8d314a30ba69ec4ea663bcfb6d0aec5650990604f4eb87650e28
MD5 5241108d7ad99e203d44a660ad893bc9
SHA1 9aaf2c152548980908588593870bc9d9fa667c14
SHA512 f6d1ea17c12274499649a57b584824ccf5dd06cb9c8e2a3bc713e0a85f1945ff2f9dafaed4d7267b0a29f304396eee9458650854e8feb35e7285e01d4ee4d084
SSDEEP 192:UYUU92K2jY0E1iKCq3wzR5KC01xAkIuxAk60W41E5kCT4b6epRX:UYdIK2jY0E1iKCq3w/Oq+qSYT4bZ
TLSH
T14492DB427A00C683E8A76B70CD6B27683772D7EAD751578B01CDD0304E937C66F9A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c624.rbs

Path C:\Config.Msi\e58c624.rbs
Size 19KB
SHA256 b5f00e3ecd24636070aad20aa31e6951b488195b3cdbb07d398ad13f732c1eb8
MD5 1f1e0c0bc50cd0e5fd6687dfb217f731
SHA1 c5ea350c4eee8078c1e95a11ff05627200c71638
SHA512 d210b7c170b056db6c3cc7226c26cd856b5ecbde99fe584e3c244dbad3bdeea709fdfed3efdf6c8cd085c2c2384859258766082160e6e9fdc7200a58e5c86cdb
SSDEEP 192:/OYPhX3IR0Co2YUIEYUSyrjnyEmqUxOpw:/OY53AYEYoIr
TLSH
T1F292E9436A10C5E3E8A76B71CE5B0B163B72D7EAC354634B44DCD0304F937CA6E9968A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c62f.rbs

Path C:\Config.Msi\e58c62f.rbs
Size 20KB
SHA256 0069864fb408f1cbee6e3fca855262eaf41b498696bb594602c122310d7d8ec1
MD5 36d75050e8509d09312d8b36c5561408
SHA1 61a7248e9c4cd49a9d46435545940eea61d7899d
SHA512 10bc433215b5f2b0c969e40c61bc2d4b648f75f5cacef25c51315cf49cc5df3c81e3a4aab1a94de4320d80a0f2f2fd45654179b024706a7388f091eb4f5f49b4
SSDEEP 192:/hmBtwUk0Ve2SD4QsUh+u6RJC/2tUIltU5uDhLW5LsUErLrS7aOpsH:/hSVk0Ve2SD4QsUh+uAtlthlKQfS7G
TLSH
T10D92A9427A00DA92D8A62B30CD971B293372D3DAD751534B01DCD1744F937CAAF9AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c634.rbs

Path C:\Config.Msi\e58c634.rbs
Size 1.1MB
SHA256 5427d558c77ccfbecef9a717b310a25dd7efa6f13eb23394a6e9cf1d88479752
MD5 f088d0fae27490ff1031cfd43d34f3ae
SHA1 1fc77047a43befaa546877cd4afdec02eb09e62f
SHA512 e782175d632aa950e7c0c0e98844ae313675e9ce374d3396704062181fe901375e3599de271a84772c4b6b5bcd1f8d89b06a939472fef0e76e684e4deea616b2
SSDEEP 24576:IBcrEe3eybfahwXDpUpPIhwXDpUpPChwXDpUpPthwXDpUpP3:9uyuhwNUxIhwNUxChwNUxthwNUx3
TLSH
T14435074173E44175E5F7AA34D9F24A16BB73B8525B34D3CF0254862D0E72BC0AE7AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c635.rbf

Path C:\Config.Msi\e58c635.rbf
Size 44KB
SHA256 b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e
MD5 bc959a160882b0de0583047b1b5b93a6
SHA1 78bda837a0fcc25623b54e95f3eff76c3bd79332
SHA512 7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd
SSDEEP 384:sA4dzYZj6Tt3jmpuXkGtrfK76lNWg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+7n3n:sHK6TtMGgpFiJi3SYDw
TLSH
T11013541C97E70712F2B34A719AF150C24ABEBD03BEE6E77F9B45030944616884992FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c636.rbf

Path C:\Config.Msi\e58c636.rbf
Size 41KB
SHA256 4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806
MD5 91ceea551937cb5da627f33ef7995ee8
SHA1 4e7483605c4027381e4796345f0a0e6aa9342a5b
SHA512 2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9
SSDEEP 384:XKBk39BmxOVst4SCtrpuXYa1pbr/0K7yKKJ9Yu6dnPU3SERztmCJMadMardz/Jiq:XKGfZs5CZqljU6rqnuqzeEfViIF
TLSH
T1FC13B529D3F84712D2F74BB16CF1A4835936FA539EB8DB5C149A530A48133D84E62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c637.rbf

Path C:\Config.Msi\e58c637.rbf
Size 76KB
SHA256 972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867
MD5 7173d17aa9ff4cda07fbfff21a584a67
SHA1 37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc
SHA512 b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167
SSDEEP 768:MTcr9yq2UX/RPLYyODdyoSNjSvYomC+L8XW/FuhyINGLTGnBEPzfsTKJzePDFiJg:9dVV8XW/FipNGfGBEPz0ceceimOU
TLSH
T1AD7385189BFD0722F2B30B71EEB684C15E7FBE277912D61F5508414E2491FA488E2B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c638.rbf

Path C:\Config.Msi\e58c638.rbf
Size 35KB
SHA256 06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39
MD5 da7787ae5278031ef79441d29599dcff
SHA1 4e2a4c70035808dd8bffaeb6ded8fe2980566e0f
SHA512 2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e
SSDEEP 384:neght+fMtSM9jmxa1CFbfKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3hW8zNWZQ:egX+EtkqR6rqnGHKoVijm
TLSH
T181F29529D7F84712E2F347B1ACF684836976FA13AE78DB5C14C6534948137844A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c639.rbf

Path C:\Config.Msi\e58c639.rbf
Size 35KB
SHA256 b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa
MD5 86a1d818b679edbe94ab51b963ba79a1
SHA1 2b9ee6b54aa2f709442e7e514335e2548c933318
SHA512 ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9
SSDEEP 384:6kQOJrYa7mdessomj5R/yeizfa19xrwKJ9Yu6dnPU3SERztmCJMadMardz/JikPg:tQOVYoxVUqzD6rqnz7AWpLrFVieG
TLSH
T1E2F2C628C3FC8326EAB34B70E9F594876937F513AE76C7AC1499530D08227944523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c63a.rbf

Path C:\Config.Msi\e58c63a.rbf
Size 21KB
SHA256 0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956
MD5 6083b2909a6c1ab52ce84da1b435e7cf
SHA1 e851ccddf1fcb0c2fd9cfb4a357f72633452f240
SHA512 53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1
SSDEEP 384:WK2RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYW:TurKjgEnGEFiJrvPA
TLSH
T1C6A22628D3F85721F2F34B70ADF284839973B913AE79D76D2586030D0866A449963F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c63b.rbf

Path C:\Config.Msi\e58c63b.rbf
Size 24KB
SHA256 4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb
MD5 d87310699e3baac5ecc0f64673fe3485
SHA1 34460b0eb74977b98d9d3e683d5ffa2aec11059c
SHA512 096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38
SSDEEP 384:CZp0wdaXOa1FOKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81LUWIYj3gWUXRm05:Cz0Ka+qb6rqnDnOVi+t+8
TLSH
T152B22428D3F85312E2F38BB1DDF58487A976BA53AE35C79C2596134D08227844963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c63c.rbf

Path C:\Config.Msi\e58c63c.rbf
Size 280KB
SHA256 a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b
MD5 a3ae8e892e025e479978fb07fb449784
SHA1 71a1641ffb0da859af5e355c5bf4a9bcf1746e74
SHA512 e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54
SSDEEP 6144:Z/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvd:+777376V7777U77aPMKIXaXce7mNTp8Z
TLSH
T19A54F8A6A2E84F22D3FE037920F1554B09F1EC17D64EFB4B684082F56C1B7A09A63D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c63d.rbf

Path C:\Config.Msi\e58c63d.rbf
Size 108KB
SHA256 6e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6
MD5 1c8e5ef9f86430fbda800e45c0a89aa5
SHA1 4e18ee249a208dbf7d7b52d412fa0d402fd3ff2a
SHA512 721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66
SSDEEP 1536:64OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQns:6rjoi6vdu0Ow6tKGfU+IN93s
TLSH
T1D2B31A1093FC4721E6F70BB57DF6A0418673F9229EA3D31D1959060E1826F948EA2B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c63e.rbf

Path C:\Config.Msi\e58c63e.rbf
Size 152KB
SHA256 a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036
MD5 6742f826c21773c933fc2a68ceecb99b
SHA1 dc689d3fb31e7cab6a33cd2192d6114542173514
SHA512 4138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a
SSDEEP 3072:Z0anyn/CiBk6HOIz42IJqFF/0/WAWwerjeVPt:Hn+Va4k
TLSH
T12CE3295A63EC0716F6FB0731A8FA54416EBAF8032966CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c63f.rbf

Path C:\Config.Msi\e58c63f.rbf
Size 140KB
SHA256 35cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a
MD5 cad14a2ced4a556139097c1f716eae70
SHA1 9552115b645c17165bacc2231725b3f8073105a3
SHA512 df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331
SSDEEP 3072:wAyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcj:wrIMFRuf
TLSH
T1FAE3281963E81B1BF2F70734E8FB00824BBAB9077967D71F694E41CE05A1B844662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c640.rbf

Path C:\Config.Msi\e58c640.rbf
Size 189KB
SHA256 f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57
MD5 1f50737bb92b1f71b15824a0f113d3f9
SHA1 4d78793ea921986d011a024b91ac59d6c02de6e0
SHA512 89e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4
SSDEEP 3072:Lcs+QnXsia21rUBJeImxRGluQriZy+GZ7X/kMIJo:LcsrRIHiYYK
TLSH
T1CA14192467FC1B11F2FB4B7AEDB5A0019A76FE662D13D31D15A0419E1872B40CAB2B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c641.rbf

Path C:\Config.Msi\e58c641.rbf
Size 76KB
SHA256 dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361
MD5 d68368708be2b6dac797743e23dbf655
SHA1 e843b858d72359ecf6fcdfca328ed19a7f23210b
SHA512 2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e
SSDEEP 768:nI/327083Js1D8z1bKta9mqfVD20avQwiubnW2yCzT/8yA:nI/320UJsbta0qhRwfLyCzj8yA
TLSH
T17973F700BBBD4BA9D1FA0B7AA8B990109471FE557813CA1E0E94B14E54F2F90CEB1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c642.rbf

Path C:\Config.Msi\e58c642.rbf
Size 428KB
SHA256 13f36534cf603cd722ac9078e51930cba190395d23d6688b65a8c788262759e5
MD5 9e877ffed2e2c9a013c59581f88786b5
SHA1 d3bbb3e2c36520ec267463916d3356bf4fcd8037
SHA512 5b4ff6de141bf2dc321dfa05fe8c93f64ca91eae6b41041264736c3c6db9d0520c135103873c5f32a47c742fb51317b3303e7656cd259331113f9b876ad17613
SSDEEP 6144:7Nu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJP:Zu/UT4HQ+hpxK1/
TLSH
T1CE94E71023A88E2ACECB0275E45BC6158674DB0A76ADEF5F5DF5E2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c643.rbf

Path C:\Config.Msi\e58c643.rbf
Size 292KB
SHA256 d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c
MD5 bc9a83d77cae33f9eb9bd538ab65b2a1
SHA1 363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8
SHA512 37ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57
SSDEEP 6144:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfM:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvZ
TLSH
T18B54F816277C4A2FDA6B0674F5B2067106B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c644.rbf

Path C:\Config.Msi\e58c644.rbf
Size 128KB
SHA256 c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef
MD5 c7fc5f01de9577403a1ea8aafad79e72
SHA1 6422fa355184394ace02c0ba88e5b8af3db7fa6c
SHA512 b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87
SSDEEP 3072:HEmV8EKUaX1IrJeE+6pwluGCulHxTqo+Ue:HEm5azUaxW
TLSH
T126D31A01B7FD372AF2FB0B79A9F96001C97AFC556A26D78D1851424E04B5F808A72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c645.rbf

Path C:\Config.Msi\e58c645.rbf
Size 92KB
SHA256 6e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5
MD5 535d9d8441e0e22aa3f407c7197f8a0f
SHA1 ec6d047e975c107a7ecdf78bf352a5a68f53392f
SHA512 f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e
SSDEEP 1536:KJr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016:KJi6vPUL7zxwXmh8Gf99XZ
TLSH
T1CA93E82493FC4F61E6F71B742DF6A1814A72F9625EA2DB1F102D410E1D23B948972B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c646.rbf

Path C:\Config.Msi\e58c646.rbf
Size 356KB
SHA256 8186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090
MD5 5e1a793d9615d4d9e153ee416abc83ad
SHA1 27d231f4d1e2b473f9695daa21b22804db779826
SHA512 f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876
SSDEEP 3072:JBijFKiOKL/u3RW1NvAbugFh/jLqthte2Seh6GVa5DU91Tp01sq9kAaCXrmRKHpH:jIZrvgQKA91TnAa+tPvH
TLSH
T1B774C62073F95208E6B70B30AC7651C51A77BE67BE15C62F2449324D6A72B938B23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c647.rbf

Path C:\Config.Msi\e58c647.rbf
Size 352KB
SHA256 8da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296
MD5 03898441f5d9a8809c04fe746fd498b3
SHA1 35cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6
SHA512 dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12
SSDEEP 3072:DAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Ex:DAikDFsY3IYU+uojT/xK6ur6EaPef
TLSH
T1D174C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610E1871B819A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c648.rbf

Path C:\Config.Msi\e58c648.rbf
Size 82KB
SHA256 33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a
MD5 f148286b321ed09c2d17e9e3637c807b
SHA1 b0928429f52028b512dad9c7e0996ee7ade315d3
SHA512 d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b
SSDEEP 1536:mkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79WShdMUVV:mk3gCbzexZG0YUBXfqidZhdM4V
TLSH
T155836B17A3EC4B13D3F64630A8F09A03AA71FAC37566D79B30466769089B3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c649.rbf

Path C:\Config.Msi\e58c649.rbf
Size 41KB
SHA256 27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db
MD5 e3c8239a97601bb203b9e9037eed89c2
SHA1 75f0e5f417477d4c491e8ad81f498faf761618a1
SHA512 71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2
SSDEEP 768:Jc1JB9Xaefxf2ZquXoQGaHQ6rqnig3qTVi:O1JHXtp+ZquHHwig6TV
TLSH
T1FC13D72493F80323E6F347B09DF194839A37B953AE25DB9D1099574D0812BC5CE62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c64a.rbf

Path C:\Config.Msi\e58c64a.rbf
Size 76KB
SHA256 e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457
MD5 219c69df0c23fdaf84e4c9ea2835a628
SHA1 d3b091bfcaa8506d299cb1d7453fdce7fb27dafe
SHA512 e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8
SSDEEP 1536:SdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHN2gxyVu8:4YR63P8dlNGu1IcT7TXLqbgx69
TLSH
T1B373291193F88327C6FE43B564F0A8125FB9F653BEB6E71D0885939A48537C08D52B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c64b.rbf

Path C:\Config.Msi\e58c64b.rbf
Size 80KB
SHA256 5a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d
MD5 75e8bc00ad7da1e7628f146dc33cc83a
SHA1 b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e
SHA512 b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3
SSDEEP 1536:4Uy56bAm4HNNN5AU+QO2TFvKe/elIQcmEtli/G//ZgUKtmOo:Iu4HNNNmdy9EUIG/qlY1
TLSH
T1B8831A1993EA4B13D2FA0B7898F154C24BBAF5037DB6E72F9A46124E04933C44962F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c64c.rbf

Path C:\Config.Msi\e58c64c.rbf
Size 48KB
SHA256 e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f
MD5 775dac5f81248b14182c82013672c42e
SHA1 cef7bba712b25da04f60f597cb614c7e4b87f24e
SHA512 2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c
SSDEEP 384:Qeg/3V8jOAfSr7CgWzwL4/7y24p4kwo6972IbL8J717lw2Ghr49gpWg67KGhJSxl:V6l8HKAMs/+24E7r8LVGUFiJzFDQ
TLSH
T15323321C9BE75323F1B64A71EEF145C24EBDB803B9A6A73FDB451608089368844D2F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c64d.rbf

Path C:\Config.Msi\e58c64d.rbf
Size 24KB
SHA256 db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236
MD5 2a9b706d83be29f32a28f29be397e533
SHA1 31135de80dd7b7c4a27516806fbbb13d871548d9
SHA512 cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64
SSDEEP 384:w3K6a/IZa1nKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CmWbzpWZDzDm0GftpB/:w33qA6rqnLPAVip
TLSH
T1ABB20428D3F85312E2B38BB09DF5C487A977BA53AE39D79C1496134D08267C44963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c64e.rbf

Path C:\Config.Msi\e58c64e.rbf
Size 36KB
SHA256 f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b
MD5 bd3e2c28c647533a057b5cdf8bff2c5f
SHA1 d36c80e460c5dde615ab1c268bd89309225ecb82
SHA512 14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc
SSDEEP 384:NQK7QQZbXvJ5qCmIG7g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+G6reVxW8H7W:JbxjG7FiJH6a1
TLSH
T103F2AF1C8AE70652F1B24F70DAF140C25EBEBC137DA6676FDB4607090C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c64f.rbf

Path C:\Config.Msi\e58c64f.rbf
Size 52KB
SHA256 9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4
MD5 63a1e9cde10490008ba7ef47a12179d1
SHA1 5299af182b7cf08f95fcb3815149d7c54e73187d
SHA512 dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe
SSDEEP 1536:oy8H8QhPyUv8whq+927kgF1fGguNnJKIZ6:fZT1fGfnJrU
TLSH
T10F33C81897EA4722D3F70B7198F245C24EB5F803BA77E79F0A4853491C52B848D92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c650.rbf

Path C:\Config.Msi\e58c650.rbf
Size 36KB
SHA256 19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b
MD5 7a016cec8851a57b2f0376ae6d1fc837
SHA1 f161f9d8d7b073c1f17f55719c37124969bd7d2a
SHA512 f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456
SSDEEP 384:Q5Qndl5IG9g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+GwE/778UWj3CW:eG9FiJHF/cJ
TLSH
T187F2BC1C8AE70752F1B24B70DAF140C25EBDBD13BDA6A76FDB4507080C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c651.rbf

Path C:\Config.Msi\e58c651.rbf
Size 64KB
SHA256 0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7
MD5 4d4774a30da56119888490cdf3157b09
SHA1 360221725daa9b7a14460fe6939d54b2173fb8d1
SHA512 eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130
SSDEEP 1536:9pvk2mCtNGNMGfRfESSgOX55uKG/SmawWQie:XkEGfR8SSgOX55uKG/SmaTE
TLSH
T10353B508C3AD8322E3F607316DF186825E71F5437A39EFBE0946375508AB7C46562BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c652.rbf

Path C:\Config.Msi\e58c652.rbf
Size 62KB
SHA256 c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1
MD5 9002a577c07ab2b99979435cd8b67acd
SHA1 5b3c6231c113b726ddd55fd8a8e3ae84b1526820
SHA512 f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47
SSDEEP 768:mdgc7HHzMKqYyb6FZZ3JEMTt924zM8X79qZI336rqnbsWraHngVinE2:fc7HHzMKpyGZ3Jr249XJqZqtbkAVQR
TLSH
T1E2530814D3F88723C2FB87B568F148839A76F743ADB9DB5C1486532A04577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c653.rbf

Path C:\Config.Msi\e58c653.rbf
Size 61KB
SHA256 241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec
MD5 218e31b07c6e07633a84f0248730e220
SHA1 47ee36529b741f3d52c487e6dad151f516c2eb5a
SHA512 e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0
SSDEEP 1536:ran8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsNjNPBDWGVb:NMPG7wqhDW+b
TLSH
T151532918D3F84323D6FF87B8B9F195435A36F843AE62CBAD188A538905533D44913B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c654.rbf

Path C:\Config.Msi\e58c654.rbf
Size 81KB
SHA256 ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650
MD5 93030b5af327ece3ddc3518410e1af59
SHA1 4be27729a906169d2afcf025e10f308fce35056c
SHA512 247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d
SSDEEP 768:PVQ+jyq2UX/RPLYyODdyoSNjSvYomC+L8XW/By/g6I+wVtB4dmg1ZqnBEPzmhK7x:S4VV8XW/Og9NCJ7qBEPzmW2yZAW7KVg
TLSH
T1E6830955C7FC4726D6B74B70F9F78446A633F967AE23C78D1408824E2851BA484E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c655.rbf

Path C:\Config.Msi\e58c655.rbf
Size 200KB
SHA256 ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8
MD5 c30dfa5fbf9f2e6d18ceb7108923fdfc
SHA1 523c4b9043cd6d722c01215f64173b9287623d76
SHA512 075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2
SSDEEP 3072:20ZVVxFlfJ57iPki4i14IBkb2/Demjzk27wxqWSDsKnFp6/M/CP15rFJgStL+L:t5Pu4M4IulbK3C6
TLSH
T1D0144B1663FC4726F6BB0B35D8FB11026E7AF9172967DB1C2889068E0971B809973737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c656.rbf

Path C:\Config.Msi\e58c656.rbf
Size 197KB
SHA256 19e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501
MD5 fca2f9f00de26d0b5af4881836d6337a
SHA1 b11dcad7c00c2c85354b131c796ae34bbbefdb38
SHA512 7fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738
SSDEEP 3072:/rFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirW+Y/43zNFk1C:/rFAoOXcHfIfiA+/
TLSH
T100142A14A7FD1B25F2FB4F79EDF6A0018A36FA262D23D71D15A0015E1876B40CA62B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c657.rbf

Path C:\Config.Msi\e58c657.rbf
Size 27KB
SHA256 db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57
MD5 aa8ef0154efa83de1c2786ab1cb76f37
SHA1 5e4fcdf55c34538dfdda172a985731019f74898f
SHA512 17d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd
SSDEEP 384:eZPbNawkFSvPSN4J3DztyJbDr3Zcv+qLrVAtJCl9F1WijgW1Qim0GftpBjF9ZE:eHaVFSvPSNEtyJvrpcB9qi/bfVizTE
TLSH
T170D21A00C7FC536BE9A70A717DE59981493BFF52AD23E21F4068C05E14E9BF48A66723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c658.rbf

Path C:\Config.Msi\e58c658.rbf
Size 15KB
SHA256 1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099
MD5 62faa6fe395c5810fe4fceffcba62966
SHA1 ed830d3d1156c3a5ea6502148f4347af0c4a8051
SHA512 4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54
SSDEEP 384:21LtwmrH+mFqmwW/zwWUQim0GftpBj6XY:21lFpGfViWY
TLSH
T1D572F905D3EF8EA3DC825D319DF187827A3CE7834D62DB2B4159D16A2C633E8C961B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c659.rbf

Path C:\Config.Msi\e58c659.rbf
Size 90KB
SHA256 ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9
MD5 facce237d5cc5e89d8e92a36289f588b
SHA1 5b91fe97781b107df2754a5d38807a597f1d99a2
SHA512 f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0
SSDEEP 768:F+nOfOpzCJztUjm2ElyGv/NIvS1SHhodPxAoiStZp4uXhblMB/e8CKMduoUZKP4d:yy+zGztUjm2oNIv5oiIZZz8C2D4RRVZO
TLSH
T15993F626E23684BDDCC9003C75983531A73CF3B78256A78719097DAA4DD3B8BC987B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c65a.rbf

Path C:\Config.Msi\e58c65a.rbf
Size 168KB
SHA256 1246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879
MD5 d2d2a9e08ad2df5d73ca0aa0797cd96a
SHA1 f6050bc38d27c805daa078383506b93c5dd854c7
SHA512 197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de
SSDEEP 3072:fWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vam7xBAZiruL2b:fnMr8CSQ09ap6Jy65Rm2vp
TLSH
T1CCF309C1AB0BE061DC89563C38AA7F056F3CFBD295D2AB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c65b.rbf

Path C:\Config.Msi\e58c65b.rbf
Size 55KB
SHA256 89885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55
MD5 158f96bd130a9f3a1f7e91dc611e8b7d
SHA1 207264f61e8d8cd77c7dd82e7c8c38927bcdef85
SHA512 6ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a
SSDEEP 768:+RXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24hbxocNAwkEGjhl2BOBaBnD/sxFsNTl:ZSk2HQq9D2bPeVqv
TLSH
T19043A342D21A96D6CC55A5342A70FB52E63EF3FB1BE1B65F8813CCF408A3250E945F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c65c.rbf

Path C:\Config.Msi\e58c65c.rbf
Size 139KB
SHA256 38f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5
MD5 32f2ac5f45b93b733cab1865affd588d
SHA1 5062e6d2a8c1e06e19c9f0b29164915286ece618
SHA512 8384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1
SSDEEP 3072:DrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO++rCo9D5:DrwBZWkge7Dur/n
TLSH
T1FDD33A91EA35C259CE84C47D3E21BB00DB3CF3D644C2AB9F4526FCE84A8B791C552E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c65d.rbf

Path C:\Config.Msi\e58c65d.rbf
Size 351KB
SHA256 55758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e
MD5 18a9dd94b5112ea94f3fc9fc22ff8409
SHA1 97a0b82343ef1599e517946a2c3c259b61e53ca7
SHA512 7bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6
SSDEEP 6144:ENeM8oM6s8alZ+afj5OADOQ4pUE9wstZY:49QZ3j5JOQ4pUE9wst6
TLSH
T10274A415A3FE5761E2F30B34ACB40489DAB6FD479E6A974F2445A15E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c65e.rbf

Path C:\Config.Msi\e58c65e.rbf
Size 456KB
SHA256 a5a600ca8a60a0af629047ef8b227feba5221c5697f820da69e274f40869a6cc
MD5 54c12705dc6a32282762bbc4252e2b9b
SHA1 2d1fd38b5f3db7c7f0d7baee446a00099a506d50
SHA512 c4d96a8d8064ef917ddb98532360a8bf318535b310f908a384c0ca140ed058f5f3f24f34c3992da4399386f546381cbb1eef5432b3ff2b7c19e0491dec8d4aaf
SSDEEP 6144:I6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNic8iV:I6jwRSvQh42RNjN6YV
TLSH
T124A42B12C279D33EC2AE833754A226155BA5B2EFBAF1EF53A013C5E82C537C09D41A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c65f.rbf

Path C:\Config.Msi\e58c65f.rbf
Size 137KB
SHA256 7acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83
MD5 9f735917c0bba0f42b40e719047eefd5
SHA1 d8c1ef036b9d841db86ffc76d9150064ee836cce
SHA512 65522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e
SSDEEP 1536:I2jLPfRUqxc0O/t4DErSu9e7EMaggaqRgDPRpTCWFVmI:I2fPJUqxy14DEF9e7D3gaqRKPDrfmI
TLSH
T120D30A00A3AA0B92D06155351FF2B942E63DFBA76AD5E75F5421CED80CB3B90CC22B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c660.rbf

Path C:\Config.Msi\e58c660.rbf
Size 334KB
SHA256 7150db5b3af392a250b79f1078c87848a08b6c13448943d5a0478c2d37645b85
MD5 4b15c6de8b0cbeb6d4d7d6e14b9ca7fa
SHA1 af3b589712be828302778a6e248ebd659fcdabfe
SHA512 1f68f55cb4c32d0abf929b3382d9b773369f376853912829299c6386648c39807c6242eba037bb3988ebecd0e8b7197c91583243154c569bef1f70d0d958c491
SSDEEP 3072:700ASicZpLom0Wy0iwsC+KHIVKbHWuFvUOLKZXXZF6jJfIMRFxtZYg7eyXgMly3C:jlRAWy0iDCyVMvUYKZ+JICHNyPOB9Y81
TLSH
T193741B154268C32BD5E8C235BDB136124BBDF293BEF39B2B612695A81CC37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c661.rbf

Path C:\Config.Msi\e58c661.rbf
Size 75KB
SHA256 b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929
MD5 683fc126a13b915b3ff36735ea5ca5fc
SHA1 d1ccfdf78919f51b09fbde02c2cf0f332601bd74
SHA512 4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9
SSDEEP 1536:3skby0ayhkM+TeVCB5+G9cTvdQc1bqMsDvbmOpajgNiNYV64:3DbyihcwqHpa8N4864
TLSH
T1E073F718D7FA4FB3C2AA4378ACF1424256B5F402AB52CB6B18855F841D73B94CD13B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c662.rbf

Path C:\Config.Msi\e58c662.rbf
Size 389KB
SHA256 878566ee8a41806ee9b9c4cf590e1953881dde2127616a647fa31940a5096cc5
MD5 1a063e60707636e76e61ad9784bb1eea
SHA1 baf498bac402a29b1330fcd20cfbacbc5d245cf7
SHA512 39e2bcd04f4ee4e6280b7723a628acfbceef254fbea62833a34d7f4cba566c9556bfcfe2424ada027112a8b722da8349331ca416d00d0e3d6afbec96e3d91a65
SSDEEP 3072:2dxlMI0R4F60aGf0TX1zvAPuiFvVTLqtdte2Seh6mNfkGVq1XRQq7q9kAaKrVm29:nFva9GVq1XpAa+TcGR
TLSH
T1EC84F72073F94218E9B70B31ECB651C51B76BE67BE14CA2F2449315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c663.rbf

Path C:\Config.Msi\e58c663.rbf
Size 131KB
SHA256 a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a
MD5 d8a76dfe6188e600bd7a8480dcedcbdb
SHA1 40080e226be118c2a0a8f9dd70879467ec09f198
SHA512 9a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76
SSDEEP 1536:6fg4S0dRp1s8PW/OvAza4KFvQFa8xVsbtglOJzgP2wNmqgEEFBt9Aak/pKohxm3X:0N1zvAuFvVyV2sUz8mqc9AakhNhxm3Ss
TLSH
T1D0D3C41B93FC0269F2B70B71EDBE45CA5877BD566C21D25F044A368E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c682.rbs

Path C:\Config.Msi\e58c682.rbs
Size 730KB
SHA256 d5e76f4935701727d992d2a0a5dae63c2c658ed9afd79221bcacbbab84bd5aae
MD5 f39a85e73d25207f3b9e2d714050361c
SHA1 d42645a038184fad80fab90c8364c626de797942
SHA512 b4d3171585ca0a426b903734f5028614eed658655081a4802c6405c5cb30fe02a2cb89df02f896861a88562db1af8ac558ce037642a5a93297b9c90320ee3cac
SSDEEP 6144:fo6drDjORLIKuRy6QK9/NMR389050RGEkGqv3DQkgRMP7SCIS27RI88/HnZrGpaP:wAyluAN89BycS5IEZysh7N
TLSH
T182F47342714092D2D0DA1BB0C5A73F197F2BF6AA4AC2971F402CC1784C97BDDAD5EE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm
Size 584B
SHA256 3b483ce77d0ad28ae409adeafad1b169fe0400d58c37ea52d5c1ad9b93586e59
MD5 71490411a268fa02b90141ef6742940e
SHA1 9621185fea8ed8553283ce1c0d779ec7af84a1dc
SHA512 43a40b8372cfd69548b869a8fc25429ec0a37b3bcc2f94ce7ed0b7ea5d8ab9f9e21e8d471238dde7ae33515653a078eea987e29108ba9472e915beab1be1c190
TLSH
T1A1F0E6654FF2501DE2B3A67178F50656595BB4035931C42D0182318BDF317C1DD64B56
MD5 SHA1 SHA512 TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
Size 232KB
SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
MD5 824f1f188704d3de77660d90fea6b136
SHA1 9bcad1428defece9f2ceaf647d9571ca41b3f40e
SHA512 0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972
SSDEEP 3072:55Sa1UNmUq59Zh3pe8lwAx9JHHpXhvq5J38J:55Sa2qr/HHpxva
TLSH
T1E7344C11B552C133D8853332406FDFA12AAC6EE79B52C58721E932DC6EB17D4D3792CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 28KB
SHA256 2524a822d83eb2c6fd94cb986586a8f96486f3ce18041ac559475deefef406b6
MD5 952d1684d29f0c3351adaea8eb0192ff
SHA1 ada48c2992be5e70ce3ef81bc1f9b5fc95708a4f
SHA512 1f3a07703d29da1cc9cf2933659d881f064008fa556d92d90b40169fd68a954ea15e0352ac5e6e6cc7e2cb7908e183ddb15ce0719b0a27d67361e05a34afe6bf
SSDEEP 768:ZaSz7KzGs+PFJE7ynC0u5Qn3RAL9iLbO0inwJz3/o9L/Y7xoXyEMdBE2SEAgEEc4:yL9iO0inwJz3/o9L/Y7xoXyEMdBE2SEv
TLSH
T1ADD292187D8C523579F0C3B6E33592C2FB6ED5A25B30E68C7CA6C8A0746B116907E3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 9165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c
MD5 ed14b64c94f543974b7fdc592fa0594b
SHA1 dc66ca3de44c021d89ebd5160c447aaedc565514
SHA512 5d20bedcfb8d2f603b3f27d874a9e0e3a7ca7df4809aab52b02af630c0037b37923536cc93c78c9deb014df28e378d16d67e99688f8b656e3e7bfd1e2e914dcc
SSDEEP 192:EFW+NhW76T71ojDBQABJdZqnajxcRGlP6ZqDPD:EFW+NhW77DBRJdZll7P6gzD
TLSH
T1AA42098357EC5903E5976E30A3F9EAC3BE3917C629202465455AF5A93CC73DAEF0062C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 4aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449
MD5 1908861649e67cdc20c563c234a89914
SHA1 471ae3b9a3b40e63c880362892865ecf8bd80f67
SHA512 dec24d5c3f31c90cbec3810290506309a1db5677022c600d3bdd2e92b73078dc6353023f2aeefa408aceac7c9f7ed5a2ff07a399b446e177ff93e5fa1b3f9353
SSDEEP 192:alUcyiW+NhWZT71ojDBQABJctYDqnajsl/cKfX:oDyiW+NhWCDBRJcyDlPKf
TLSH
T12062D64366E43F26E99F177221FED7D72A38574214A003B4C207E58C3882796BDA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 6a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda
MD5 af851dfd0d9fecb76ff2b403f3c30f5b
SHA1 30f79fb4d4c91af847963c46882d095d1f42efbe
SHA512 04509b02115ec9b5bc4ee2f90e49e799ccf85884fe1f11f762f0614a96764b8f2b08f96895c467c5b11f20273183096b2bcceb0b769df9d65b56c378cb32b0f5
SSDEEP 192:+SW+NhWHT71ojDBQABJ/YkXqnajL1dHx3tKPDGbO:1W+NhWUDBRJ/YElXBtgEO
TLSH
T170422AC24BB85143E99B6D7052B8EB877E3CA7D66810012619AAF5993CC73C5EF11B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 2def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a
MD5 0f143310fade4de116070a3917a79c18
SHA1 b9a092e885c73cb6d33c9e17d429ede950cf3a26
SHA512 f87104272aa2326641e46450a0333626567ab3fa85a89b81f7a7c0b1f90a47a70ea189ce3f6bf5db6bb5cccda6d190fb2276edeb44334245b210e7faca05fc60
SSDEEP 192:1M81nWlC0i5C84W+NhWCT71ojDBQABJibqnajMHxxBNT067L:1M81nWm5CfW+NhWzDBRJalI667L
TLSH
T16352198747E42D12EAA71F7221FCEBD73F3E6B8108524666801BE19839C63C17F1595E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6
MD5 f97e7878a2b372291b1269d80327bbf6
SHA1 cee6f776fe0aa5a6d4854058f20f675253f48998
SHA512 475898e60ffc291362fda45ab710b9ddaf1cf5e82f66dfcc04998ded583c54692ecfcac6cc4fe21b32bdd0e4dce8ac32fd9aecca2b0b60f129415180350d7825
SSDEEP 192:lCY17aFBRgBW+NhWlT71ojDBQABJh+qnajMHxxBNT0677B:VPBW+NhW+DBRJh+lI667F
TLSH
T1524219C68ABC5943D9A36F7072E8EA8B3E3E67D128208557415BF19A3D433C1AF1062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3
MD5 761ddd8669a661d57d9cf9c335949c06
SHA1 251bbcad15771d80492f1deb001491a7abb6c563
SHA512 5ad590a5f81532f8bf21fb4f62bc248e71bbf657dfb1720b2d9f1628033afe39426a1c27a89d9a06e50849bd0ed2242afa93e4cf2bc83f03a922b8204f0f4f2a
SSDEEP 192:1T9qW+NhWQxT71ojDBQABJbcFqnajLQvTP+8jgiG2W:1T9qW+NhWQqDBRJbQlvQyUgiG2W
TLSH
T1FD421A864AE81443E5926EB046F8FB877D3E77C2182548660557F9A93C833DDAF40B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 2e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1
MD5 56556659c691dd043dbe24b0a195d64c
SHA1 117b9a201d1e8bb9e5fadeae808141d3fa41fb60
SHA512 a8d4c4a24e126c62b387120bae0edd5cbce6d33b026590ff7470d72eb171ffe62b8b2b01e745079c9a06cf1eb78a166707514715e17bbd512981792a1d2127e0
SSDEEP 384:WZVacWM4Oe59Ckb1hgmLEW+NhWvDBRJTell7P6g2:WZVJWMq59Bb1j0NS1Pae
TLSH
T1AC92D5474AD8FF67C18F17B711F08BCE6A381AA644E1B6B5C91BA0C934623C47E43A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 c136e09decf068b5f33041753c6fe9d4af7429e00bdbd8d2cb8d2a4d503e755a
MD5 e9f6d776545843a9817d8acf38d06d09
SHA1 5277698e6c9c4fd3e16757d86e1669a5fc64a6f4
SHA512 d12ee6b7afe2823632602b48d257d702552e9b644d62c0d0ccbad9f298ad9e044266baa1cbffb656075d6b5317883bd1fa3b5c29fe25e132ed61c230d3007a4a
SSDEEP 384:1vF7vLPmIHJI6/CpG3t2G3t4odXLNW+NhWnDBRJJlI667K:1d/PmIHJI6zNW1Ps66O
TLSH
T107922E6F4EA82E11D58FD7F3B5F6C7C62A351F8004C073B5A66B95883805EE9BD42E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 892e89afe2c43dd5b274abe461cb650932e8cf8ded640bc7e8e2456d08800a59
MD5 653cb5df3cec6a4a0e402b33d8aa5c08
SHA1 feb8baf43eaabbaeea4291c5620cd7626aa76fe0
SHA512 e3e673ff7b20ff7389be3299722af73a79ef8ced4a59d6b8948c6b11374703fcae16818af64338e413db3fd53d25d1d153f2d987bef6135a365481aed0c3c228
SSDEEP 1536:DW2wDe5c4bFR2JyhcvxXWpD7d3334BkZn+P+NoPKu:DW2wDe5c4bFR2JyhcvxXWpD7d3334Bka
TLSH
T1B553E5DB49E63F21E18FF7B76BFB17C91B253A0408806274EAC7556B34853A9BC43A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 52cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649
MD5 6631c212f79350458589a5281374b38b
SHA1 88be6865aac123ffbdafec32a6fba34a26428875
SHA512 e53d7bfa2639efccdb66d37957972fd1f8eb2beea3a81145588ed622501ee50261e05a06611ee7126564b11a5301b109f295d062f1a2dc1e44a2847000fd7298
SSDEEP 192:1/aitIqjd7cW+NhWfT71ojDBQABJoeONqnajsl/cKfX:1SitIBW+NhWcDBRJSlPKP
TLSH
T1A342F8C78BB81957E6675E3041F8D7877F3B93C658108135886BF19E3D82396AF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 8150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f
MD5 bbae7b5436d6d1b0fc967ff67e35415f
SHA1 f67bc165cefb119ad767b6bec27a1102c0fd2bac
SHA512 4201a8edfe303057545d04de683bbdf0acb68cf4d2e894192f899a70398df18299432c0f6caee72d917a986882bbc0585035a9b934d4579f67a1c98cc894dee2
SSDEEP 192:erMUnaPrpJhhf4AN5/KiaW+NhWRT71ojDBQABJ6qnaj9RlaHIxX:N42r7oW+NhWKDBRJ6lBR4HIx
TLSH
T10C72F98756FC3F63E9872F3322F9D7C71A366382152045798897E0C93882385FE5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f
MD5 53e9526af1fdce39f799bfe9217397a8
SHA1 f4a7fbd2d9384873f708f1eeaeb041a3fbe2c144
SHA512 8167ee463506fe0e9d145cc4e0dc8a86f1837ae87bc9efe61632fb39ef996303e2f2a889b6b02ff4a201faf73f3e76e52b1b9af0263c6fcfdac9e6ea32b0859f
SSDEEP 192:1/rjrvIDmMSNuWYFxEpahysW+NhW8T71ojDBQABJ+qnaj9RlaHD:1j3vAmiFVhpW+NhWRDBRJ+lBR4HD
TLSH
T18882D68785EC3F02E28B8B732AFAFBDB1735438224107579C507E4943ACA3997E07559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333
MD5 eccf5973b80d771a79643732017cea9a
SHA1 e7a28aa17e81965ca2d43f906ed5ab51ac34ee7c
SHA512 b95f5efc083716cb9daba160b8fa7b94f80d93ab5de65a9fb0356c7fb32c0d45fe8d5d551e625a4d6d8e96b314bae2d38df58b457b6ced17a95d11f6f2f5370e
SSDEEP 384:jsx0C5yguNvZ5VQgx3SbwA7yMVIkFGlrW+NhWqDBRJD1HlI6674:m5yguNvZ5VQgx3SbwA71IkFKN71Pc66s
TLSH
T13382B34346F83F51CA8F5BB359FADBC72A384F5225401375C467A5CC38427A2BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e
MD5 090dd0bb2bddee3eaae5b6ff15fae209
SHA1 ddc5ac01227970a4925a08f29ba65eb10344edb1
SHA512 2e0b8567231e320b2e52af3b86047cfab16824e2db1d1bb17bafe7a1c6c5f0bf62d76656206a3d7ef1d3849b479bf5e09db1f0f4e4cd0aa2df09838d35c877f3
SSDEEP 192:VuO/z7kzFDqpW+NhWTLT71ojDBQABJNqnajxcRGlP6Zq14:VPEzgW+NhWTYDBRJNll7P6gC
TLSH
T1C75218838AD4BA07E9EB1B7112FDD7DB7B3813C11A9020768257D4983683385FF16A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 e7ef5d714fc21dd1aa9db0c4eefe634463eefbd5aa4454a568bfc52e04fddf18
MD5 cc337898e64d9078cb697ac19f995c7f
SHA1 2ebcfa0cdf865fe40cbaf4ffce6d3903aea47e3c
SHA512 6960fa9617514ca223b9abda9a3a6c69cf05474b3c5fec2be6c6d5f65580c7a18e129b6d207f21eb136b0737481107e09c20b0398826284ce5f9a65a3cf8a1ca
SSDEEP 192:aBfHQduPW+NhWMT71ojDBQABJX+4qnaj9RlaH:aBfFW+NhWhDBRJX3lBR4H
TLSH
T126422AC60AA86943E69B2F7063E8E7837E3DA7C214308625056BF1993C477D2FF1162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
Size 971KB
SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
MD5 1eb17f650462eea820f4cd727d2d3ab1
SHA1 688f59160589ffa293502bffcd5c0e62e1993903
SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
TLSH
T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 5b679b8119bb5d53107c40c63df667baef62de75418c3e6b540fdbafcceddca6
MD5 8e534f49c77d787db69babff931a497a
SHA1 709380f53f4bee25ad110869ac4e755391346405
SHA512 49e293828c96f159e2311b231e13d7292b9397aa62586bd0289c713e541d9014d347cde07c8529df3402c40e8fe8a96ab72efcce9f731ba95eb416506efcdcea
SSDEEP 192:Ej8DW+NhW1T71ojDBQABJbyqnajLQvTP+8jginyR:Ej8W+NhWODBRJbylvQyUginy
TLSH
T18242098356EC5943D5535F30A3F8EBC3BE39278628605466445AF5A938C27EAEF00B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 9ce840d9a67c4700d271f27a8e5163eda506ce46c85b501687955b55fcb3d136
MD5 33e8ccbe05123c8146cd16293b688417
SHA1 d73246eb64af4f7ded63fb458c6e09c7d500f542
SHA512 5468adb8e76aced26f1f33fd0cdc72d194f92b1cbdf3f8169bc12e0eec1593f568c18d0e937898ccc3463003f939181131e41c6d5928bf393ded09c95f63e705
SSDEEP 192:cpdkKBcytW+NhW3T71ojDBQABJbkKXqnajL1dHx3tKPDGq:wuytW+NhWEDBRJbflXBtgr
TLSH
T14462E98366E43F66E99F27B121FED7D72A391781159003B1C207E59C3882782BDA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 69e2e6459ea24237d5fcfc429acbc80bbb5852044a1b79f0aa6b544c4f770d95
MD5 85ceba9a21ce5d51b35ef2de9ebfbac4
SHA1 2d695a3e2257916f252d746c5cc0b48ac2ba1380
SHA512 5d2d7e9079f53efa667f29529ce9c9c10af8d7ef541b62e2934c6b68a0a16cbfec57e49297091a99c9db3bd0674f3173036e018f6559be5d6bac554d1da8f29a
SSDEEP 192:FW+NhWhT71ojDBQABJeWqnajLQvTP+8jgiM9:FW+NhWaDBRJeWlvQyUgiM9
TLSH
T1774219C64BB85483F9936E7042B8FA877D3D67861820452A056BF59D3C873D6EF01B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 8b018f12e560d1179f1ad72811dbf7c60743061bedfa332a6562cf3db5cb413f
MD5 73ced8b30963e54d262dae2559116e46
SHA1 090e42c4b7f736e69c248ad6b790bb68b5bee9ee
SHA512 b7c0514c14ff82efbdc69ad42a3fef0a9aa1ba5112e98f7911cc6abec238980ac1104d467278608fea65f5674b6097cdccf17698c076ee14cc5d963819877ec3
SSDEEP 192:+7q6nWlC0i5C1W+NhWDT71ojDBQABJA0drXqnajL1dHx3tKPDGY:4q6nWm5C1W+NhWADBRJA0hlXBtg9
TLSH
T11252098357E83E53DAAB2B7152FDEBDB3B3D17C1055242228017E1A839C63817F12A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 bac9384ba44857279ac04865686941243ea4fac9c08c3d29feb1b53d92e76edf
MD5 4669249fb01ea369c7fd40a530966fa1
SHA1 106454588625bcf1a86db25333bb519e7f09ee61
SHA512 2036043c318d164d6701c022c7bb7569051a8fe8e87518a62fc4259fcabee3da481197a375c607ee1505ff66467dc019e1fb4a9db0087c3b0e064c1d4ef864c2
SSDEEP 192:zY17aFBRQW+NhWWT71ojDBQABJBlC+XZqnajxcRGlP6Zqgz:qNW+NhWXDBRJPPJll7P6gm
TLSH
T147420A838BAC6443E5A37F7066E8EA8B3E3E53C56D204857455BF5E928423C5AF10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 3927a4b0b4591989f8c7b25e747286b359618b4de6f7680b2230c1cfb0d12782
MD5 b23936cf83dac4b64660a88711b5234a
SHA1 61431cfb47f8d36e67d2a046db318015af4d3107
SHA512 f9c4cdda309b64a51cc4ddf0d033d2c20ec11a92b8cf46c190d1f341434f28bf683960e5ad7d06ba20776bb95f5d9725155864efe20fcb2775cf4ed2d1568b41
SSDEEP 192:VW+NhWhT71ojDBQABJKrqRgqnajxcRGlP6ZqhV:VW+NhWaDBRJq+gll7P6gD
TLSH
T18E422A868BA85043E5D77DB059F8E7877D3E23C60811481A119BF9E93C833DDAB04B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-math-l1-1-0.dll
Size 21KB
SHA256 a2dbfc1a5baa66e257a4acc63289fa73adba893f837e2b304097ab829bab257a
MD5 c1096da4634ad3356a10c00b24f53393
SHA1 6ea87bf1a88e57954f1c34047423bc342cd407ca
SHA512 d0ed94cb0b7746c324067d9485620d8693140c04c110482d685560e21c730e840056c87dadf58239f6a9f3e28cd650b0b8ecac011e03b6d6b57adc76213f0427
SSDEEP 384:kt47isbM4Oe5grykfIgTmLSW+NhWXDBRJE6ll7P6gY:kC1Mq5grxfInCNu1PEKg
TLSH
T1BAA2838789E8BF67D5CF0BB701F4CBCE66341BA154E1B5B4D887A1C834927847E4B948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 bf1292e2b4808884ef85fb40e75644c813063e34511c01706ebde9f4b5368c3e
MD5 cbf3cfc9ee1fd29707d95c63a5e7a78b
SHA1 aa91416f203466f24c0685c71a287950851d3d6b
SHA512 aafa2e8d89b3d507de47df3e908439f4d2130eb56fbd78fdf9bf9e046cb46bf7b8b93c1d6e0b5c83ea06615b78ca36b919628ed20919fc6ce373ff8c11a53b3c
SSDEEP 384:Wy+Kr6aLPmIHJI6/CpG3t2G3t4odXLxW+NhWpDBRJVell7P6gO:WZKrZPmIHJI67N81PV2G
TLSH
T18F922E6B8EA82E11D18FD7F3B5F2D7C63A350F8104C07375A66B95883845EE9BD42E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-private-l1-1-0.dll
Size 64KB
SHA256 1caa06ba419a05129a54e085aa80aa8bbe533c7276574036f75627c421cc436d
MD5 94feb4417cf3e39c8c58a1b73620687e
SHA1 ea03ac74ff1f49f93445781c90d5518f5e5d9cab
SHA512 ef1fe9201b915fb5d551c09b59846408c3ed27e5a6e832f732a521808970526a16e926b9585051d7705f363aa021ac4f087ac508c7cdf5130eb8ead77dd867d5
SSDEEP 1536:Ft2b2De5c4bFX2Jy2cvxXWpD9d3334BkZnkP8NvPIz:Fw2De5c4bFX2Jy2cvxXWpD9d3334BkZ8
TLSH
T1D75319DB49E63F22E18FF7B76BFB17C90B253A0418806170E9C7566B34853A9BC53A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 58dcf9ec3d0747a4ec23c7a1ccdb8eb0a6ad3aaebb0d8c0dd480922d012c8ecd
MD5 00a0a24bb2e9aade11494b627eb164c4
SHA1 98c1121324f8e8aaa64c673d79315cc27fa0d25c
SHA512 c8574f04172aed489b8ee91e0189314ca6b66d0d8b99275968ec888ee5c13f5f7b6d211064620b62fa1bfb6b54d7fd832823cf582e7949a07d5ecc45275b4f79
SSDEEP 192:lRQqjd7tW+NhWdT71ojDBQABJ1P4qnajLQvTP+8jgiX0/U:lK8W+NhWmDBRJ1P4lvQyUgiX0/U
TLSH
T1EA4209C787F81997D6635F3041B8DB87BF3B57C2581095658917F18E38423D6AF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 096139cdeaa408c3e3bd393a7188cbd6c296c3fe4e4cc15da113286a3f713dbd
MD5 408019e57d3d2da62a9f28389eed0ac1
SHA1 e48d1166a8fb95da90787d820ae7cae859bc626a
SHA512 fc18b2b1aedd2611ce78e92c4b283f519b5b25ebb0be5fe618a4fdbdf60c68f1edb486b74e59990e04f6b2606a9681edd433a32e6f9dc10ffe043d8dcc64eb03
SSDEEP 192:A0CjfhrpIhhf4AN5/jijW+NhWIT71ojDBQABJ9XeoIpXqnajL1dHx3tKPDGRK/:Ab7hrK4W+NhW9DBRJj+lXBtg4a
TLSH
T18E72F7838BF83F67D58B2F7312F9D7CB1A3A5382255051769853E0D938C2386BD1721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 51c54ebaec17c1216e0fcd926a2dc8a377cf278127e4fbf6cd26e0fda51c23e1
MD5 9d66fcc681389ec619d4e801f1ddbb2f
SHA1 605385439a2b9295efff604f27849778696befaf
SHA512 0776dbc733491502c84c4eb3d532b52acea0f08258647d488ffb68df2997ef4cd750b2667f94069991ac7c4001be681cd525e56af51bf1f43dda4f095f6daa00
SSDEEP 192:GFbNpuWYFxEpahjW+NhWqT71ojDBQABJa2syRqnajLQvTP+8jgia0:mUFVhjW+NhWrDBRJi6lvQyUgia0
TLSH
T1CA82D48785E83F42D2878B732AF9FBDB6B35538228147579C007E89835C9399BE0365D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 083b8b0e45864b12c60417dd3c5fe88b68ffc45a245d50df84f2a55b1dfcab38
MD5 6c7f782fdbf9aeffe7663fa1579a610e
SHA1 d1504bf86117cd552bc1b97a49745780d35007bc
SHA512 d293ed48b09a0ad5e6b3bd0ba45feac092fc4c06dcb06eb661b6df7a061e402148a31b45b2074be97b4bd6ee7daf92f60cc17e1bd4d655f4b1cbc0bf7b3c8974
SSDEEP 384:2iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGl/W+NhWlDBRJ2Dll7P6gMJT:26S5yguNvZ5VQgx3SbwA71IkFGN41PeM
TLSH
T1FD82C24346F83F52CACF57B359FAC7C32A384F4615402375D567A08C38827A6BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 7a69214583d61cca3b8d765b488d6da070fccdcc02b76ee4c66aeb809f88c1da
MD5 39f9d0f1b698d53d78c79576c7c60526
SHA1 a2015e56318b650de7436231db6a09ab95f001db
SHA512 262fd3231c73f35deaebcb5953ebe3a639d8e4461a58d546ee962f5f1e254cb40eaad235ed4c2da780b737158ba82bf7c029e35007183a7891bea307edd922b7
SSDEEP 192:famDSW+NhWpT71ojDBQABJFiRqnajLQvTP+8jgifbKg0:iTW+NhWSDBRJmlvQyUgifm
TLSH
T1BF52088346E46A07EAD71B7102FDEBDB7B3417C119D0617A8117E8983687385FE1392D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 44d5822d611fe29cb8530fe4bb86eaa8f9f2e135504e2304f8ab4ad6e37b8d36
MD5 9f9fe5f52e9b2ad655c896b849883b1a
SHA1 fd1119dbd0c38e7fc075be6a9d0efe4789f78387
SHA512 7970b3ef135423602234737da54ba6b248b670a818616f501db6e64455c7a89fdc023ddd711c6a45a7cfc25a715fa8a9c608013bca2a724f5d605b95f32830d7
SSDEEP 192:zfHQduvW+NhWnUT71ojDBQABJlzXqnajL1dHx3tKPDG8o:zfJW+NhW5DBRJlblXBtgI
TLSH
T149420A834BB85943E6AB2FB093E8E7837D3D27C5152042620496F5E93887791FF2172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
Size 900KB
SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
MD5 3df1d7da8c1493a5a00c0474323fef20
SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
TLSH
T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
Size 101KB
SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
MD5 ce18bc86e63f3192719ce0d7f286a130
SHA1 86a935fbd2fd9f5b39307ef986146cb2ff2adc33
SHA512 236bf295e0551ba64d743833ffc5c1d1b5b4915c9df5ccf3300013c765befb37808651087c388962e2f7bda0a143a406f923f408a24373cee9e6cda49aae5b73
SSDEEP 1536:7Jr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016kyBekazo:7Ji6vPUL7zxwXmh8Gf99XZ7Bwk
TLSH
T125A3F81483FC4F61E6F71B742DF6A0814A72FA625EA2DB1F102D410D1C63B949A62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Size 27KB
SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
MD5 d0958d7bb727740c9d9952b1805163fd
SHA1 a3b18971219311fd6a7e5f2be14979c3777d4d68
SHA512 138bd86e0b1f0b32ba453475e1fa81e11e9d4300db197b58301a5d478b3213079dc30c700f52220ff957fef10c4c85d1230308d83cf7560547b475fb346e1460
SSDEEP 384:Sp0wdaXOa1FnKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81dWIY83gWQsLBiHR1:O0Ka+q+6rqnDPOyBeRmoQ9zpI
TLSH
T139D25628D3F85312E2B38BB099F5C447AD76B953AE34C7AC2596534D0C227849963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Size 31KB
SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
MD5 55c9882d7612e7e8b69fa5920410be3d
SHA1 9517d22cc6d9c7f9b64d2c8152849a9075027c91
SHA512 a6fc94a8a0d6a690493819efd463b5263871346a94e7a1caa379871dd1fdc6527311b02eec70c5b49406aec53bf4e2d04d14c592754bdd3f6a251e64f9e2b024
SSDEEP 384:F52RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYWcsLBiM:3urKjgEnGEFiJrvPAOyBeF29zKk
TLSH
T1A8E2962893F81312F2F35B70ADF5C483A937BA03AE35D76D2586174D08667849963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Size 137KB
SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
MD5 b5c91699e57a807b2143cced62e70e77
SHA1 067f80a3c6b16ff9c4acff06099393084b6368ff
SHA512 d843235998b04d8f857239b31b5866c5328de3455b330f57be5f61acccdaadfa174231cbc57eb07f8cc5f7f3d8ba598fa0399fd8d13759d3c428d31a07265003
SSDEEP 3072:nEmV8EKUaX1IrJeE+6pwluGCulHxTqo+UeYBs+:nEm5azUaxWIN
TLSH
T120D33B11B7FC371AF2FB0B79A9F96001C97ABC556A26D78D1851424E04B6FC08A32B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Size 79KB
SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
MD5 2c100809815e27163493ea5e81010d1c
SHA1 01ee717e6f9d6c3d574ffe82c1cff3cf2467419a
SHA512 c22de3606e5cd1a9ac2e1cbca3c156831d5cbb99a50e4ae9f34df7d93b4d9093447d62b3fdc031be84a6c7adf16e23f7b5b44ba4eddf21bca13a26704d8a6b63
SSDEEP 1536:QdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHp2gXmyBejjzQka:yYR63P8dlNGu1IcT7TXLqngXNBCjkka
TLSH
T1F983391193B88327C6FE43B464F0A8125FB9F253BEA6E71D09C5A39A48537C18D5272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Size 85KB
SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
MD5 33247411fefa060b5f86eecd66b95078
SHA1 74784f9e3da6f1579a22f5723d46c5de50add359
SHA512 c1ad16c956cde61fee693b1483905ab6711841750bab35848a1e7261165f37273d8380daf8e6f4d2d35d520ec52fa943938f3ae7ea056a112bc9200d7e49c136
SSDEEP 1536:kkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79sShdX+yBeS2TzR:kk3gCbzexZG0YUBXfqidDhdX1B+Tl
TLSH
T18D835B27A3E85713D7F74630A8F09A03AA71FAC37565D39F2046672908AB3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Common.v9.0.dll
Size 361KB
SHA256 67d21938143f9368acf1c8c9e4cf3cc7d766cf430ae2314e633862e547e102e5
MD5 27d93e8af5f4cee915fc121075de8161
SHA1 84c40fbf2ccf8a614f45255b0fa6a1f0c9269105
SHA512 8f127be26bc002d05b5f5f3a1d509de9d83a52776d60c26df7e0c5e409a06b855845c0c36cf55c8ccb83323adc3b1e601fe701b88ce55b79e112f298aa5fb110
SSDEEP 3072:NAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Es:NAikDFsY3IYU+uojT/xK6ur6EaPef5Y
TLSH
T10D74C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610A1871BC19A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Excel.v9.0.dll
Size 437KB
SHA256 b2171260fb1e9cc28dc640f730f5a21b8538af27d0246716a19c1f1af79e23ad
MD5 a6fb2c5f09c4ee2b5256c3a58fb2b4d4
SHA1 839136ccb8a70903eb103825fb8a21b02cf397ea
SHA512 20697cdbc007dfa8e672d35d7689c068a82a6ccb3dd19b360f23c05f3a30c2e7273721d85045b1ff596d03553f7bef7de7733fbf7dfdc48b8ec4d23a4e1c1ff1
SSDEEP 6144:DNu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJm:Ru/UT4HQ+hpxK1/ewG
TLSH
T19D94F71023A88A2ACECB0271E55BC6158674DB0A76ADEF5F5DF5F2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Outlook.v9.0.dll
Size 85KB
SHA256 d43340f4c89b7ecf80004bfdeffcedbb94b6e218f2f9804643bbfa08bd8131b6
MD5 af009a95b5876c2ad8e1059151889bcb
SHA1 181370b3ef2fc8240eb01c441fb022d76ffbc650
SHA512 d4147b7711375441e6a393e9ba18191dd3caf5a1de6472ecd891ace8a11ced123cf615338533cfa6bd27a9fa9e92de3fdeb46c6e7155f2ecab9e33602eb260ad
SSDEEP 1536:HI/320UJsbta0qhRwfLyCzj8yAGjyBermVzpv:HI/3VTqhRqLR8yAtBPdv
TLSH
T103831700BBBC4796D5FA0B79A9B990119875FF967802CA2E0E94B14E14F3F90CA71377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Word.v9.0.dll
Size 301KB
SHA256 978413ad8b26182656086e7271cfc30cd201abc2141c76cf2fc1eb3c472e7f4a
MD5 6b4df7cc46e556f0605529ef5f2388b4
SHA1 78d27476b9632cfe4758cdf72657ee9c308590cc
SHA512 94ae8fd6750e00d56a36373e4f5434ee03dd9840315a8bf92047316a220d5a0f234af3ebd39747c0e335dba862a05dd77e91be21f86f6dfee548465b9d1b9363
SSDEEP 6144:f/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfd:f/3++m0QBrwOMPL8R60SxaS7Qa9Cngv0
TLSH
T18C640806277C4A2FDA6B0674F5B2067116B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll
Size 117KB
SHA256 cf7b8a47428bd4f204bf77509dcd2f3e5891f65d4f0a367ae45f80fc0e4d6594
MD5 e1b99ccd7cd33bdf1b3377ea678b2b46
SHA1 f9286981d561a0705f8371d9b5989fac71190c58
SHA512 3a69d0550d3115c6b5ebbd567efe4183f16439e93e54af3d229f6b27e9a136db14ecceb40ec9cc476285895df79a7238d296746448f5fbc22c579132a1f747fe
SSDEEP 1536:g4OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQnsPyBeA2zO:grjoi6vdu0Ow6tKGfU+IN93sqBA6
TLSH
T163C33B1093FC4711E6F70BB47DF6E0419A72FA635EA2D31D1999460E1822F94CE62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Size 44KB
SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
MD5 c2e0ecbe64eb072ed008257142315526
SHA1 3d732f858fe67bae8f369ef19ef282e11a83f656
SHA512 5e0d2a7484e63254e455d6e9da44f79533638607e41d7c4eaf77529f6dee50904a675d8695a8e5c0ac835e813f2a7e11e7b1e0cfdb82553edf653451fe816203
SSDEEP 768:Tc1JB9Xaefxf2ZquXoQGaVP6rqnig3MbvyBeHO7Ex9zQB:A1JHXtp+ZquHVVigczyBeHljzQB
TLSH
T17013D72493F80313E6F757B099F1E443AA777953AE29DB9D1099574D0812BC1CA22F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll
Size 289KB
SHA256 cf4a264e243cfd6d9ebbdc100bc9b0bdc1bb178bc5c9bbc141407a11bfabd8cc
MD5 b7b9a43fbb8f9657cd79449e5eee1839
SHA1 feffed24c3e4d0f4c452400576a93954fbe42be9
SHA512 118d7426296644c2e7f3cdb3b3e99bd8e7b95a9c0d28b529292ed968b87d6e61e1fc66455e9ac935283d71c3aa1892f61da1fc24b85c4dfffcede9901eb6348b
SSDEEP 6144:g/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvdRA:P777376V7777U77aPMKIXaXce7mNTp8Q
TLSH
T10854F8A6A2E84F22D3FE037820F1554B19F1EC57C64EFB4B684092F52C177A0DA63967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll
Size 149KB
SHA256 364f386f97281ff3a80fbf5aa93207d35cdcf21d4a32fcf1a29c3861c8794671
MD5 5407ed386851928a55bdeb7343547e77
SHA1 7754cb78c8c6fd85c0c303a602fe93c6a3be2170
SHA512 fa3cc5c5723a4c4f7e355041162b3d55576c45f0f81076c2a14f9f92d996870a5a10cdf869773b76585d40bf5d0d52f15f4d6b8da718b4b22b4ea7132417880a
SSDEEP 3072:6AyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcjCBPx:6rIMFRufYp
TLSH
T11CE34A0963E81B1BF2F71734E8FB40825BBAB9077963D31F694D41CE05A1B848662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260605092318.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092318.log
Size 6KB
SHA256 dd0a75e977a988d3598cbcb1320dd19e0e0400e0fb6af1c9ff007ee75abfb64e
MD5 042a08b6a58747c034a6696205aa3fe5
SHA1 b62147d530b0222c23c94c0810d3330c83c569c8
SHA512 38b47a2e30d55a660dec00c1b88da848c6cdc5837003b65983b1b6f25ae36ad0fedc4138b8bcf6e6916288abfef9c7431f631e9f991514b8bb09701623dec721
SSDEEP 192:7hVheg2ehe5eYeKQmh6oh2Gzh5hTeO9hvhqhyeue8eEXqhBeZe8hAe5:NVhePehe5eYeq6y2GF/qOpQyeue8eEAG
TLSH
T124E1FF024BC7B3DA39D0E1A6D6A4FB998B79BC185A4166F077E923D8C2014D0DFDEE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260605092318_0_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092318_0_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 be8afa259e96ee42c2790fe73771dc8575dbeef4855a22b2cb77ff64ab70f56b
MD5 3d4ea2f2e9e477a8dac5f59d92f6c0d4
SHA1 8eea20d9d28e1c1d505e4d25c2c8b9f0d476c656
SHA512 6e6a088a589f7be5803f3782804d0e1f5713de2cf5b84e3eb1eaab1105037a6a50bdc49ff007024c38193ed75b0d6e2b80e9f87139fa08c7e42c4cf2f6481d65
TLSH
T1C541E5551EE50C14B1B35B47AAF3C4530E73FCD76974AF0C32C4835A06ABD0968697AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260605092318_1_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092318_1_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 8ecade8dc4089566c45cf249951d3f5d533b7e0165f0313b5e3630eaab8e28f0
MD5 db91e6631b19511fe7f3c9f1b97a3e29
SHA1 03ad9abea1da5a1f566d4291b8720ccef4c483fe
SHA512 c1e3e16107cfda12bbdc0ade2257e5ff604efce62446185c6b3d9a88330a8689f0e45c8cdb691d79aa7309f66b60ed3c2a864d68b1b97f7e451deb2fdc47bfe8
TLSH
T1FF41D56A1EE50854B1B257879AF3C0535EB3FCD76834DF0C22C48369066BD046D587A7
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260605092323.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092323.log
Size 7KB
SHA256 2281c7fe61ad63cf675c0afbf215f374ea26958350f50479c6a67562b3ff443f
MD5 d00fa2ab1b3040e205d9691bdce356b0
SHA1 1cea5165ae8446a0ffb7119be096e744ef204e00
SHA512 17dcfd59bca84f8d7be089fabc30265f747fc05261604e02cb85086dbe838b526e329b52bb516b3cdabb0a7bd912f9b9d0e21d5c533b41c92e3dce846ffeaf40
SSDEEP 192:g/eEele1eMeXlmz8fDGe8e2ehr/eXezex:4eEele1eMec2Se8e2ehbeXezex
TLSH
T179E133031BDAB29939B0E19AD760BDD8CBB530593D2957B0BF9D51D8C106CB4CB8ED82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260605092323_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092323_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 85d915a6f628b8d1933d62456d4ce7c2d441c727d83e866baddf2f732a9d7123
MD5 b8a33b1260d15dfed27ce8f586b9dd41
SHA1 8e8716f2ce6193c5a38e5b9b8a1ee124009c378b
SHA512 5375cf0b4696efcb6bddbf8e4b2b906be96d83ec0750e00100d4346b96fc43f96d36883207a715e63f98a4655b43aff5f0aec796467da25cff038dee66ae0fb8
TLSH
T18141F56A1AD45885B0B657079EF3C0526E73BCC27834DF0C23C5935E066FD0968587FA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260605092323_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092323_001_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 ffe313fc974e8e74dd4b1777631d8b46456e2d84de70d68476030a6f1f57695f
MD5 5179d682d8dcd5fb7649914ef9eb0941
SHA1 4e5918a6ad9fb1df39155be34ca93e451c483235
SHA512 c6e000a43ab792f3f062e107b50e204dbf048161bacd66941048d5e9ba5cb241a5d3f25320dd93ae35e8ae19cc4788c19d26ed283a7790faaff1e2ea84228b3f
TLSH
T10541246A1FE51C46F5B297079EF3C0931E33BDC268348F0C63C8835E466BD0568987A6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260605092327.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092327.log
Size 13KB
SHA256 57cf6dd4fed1c7167f485073aaa976a0434e902bce61eea7e8d681f2bba7d7eb
MD5 f222bdf2ec2817bcd01e91411736feb3
SHA1 334cb96ca76170335242efbe7e9930aaa7e46179
SHA512 50b6c4a1ac34270945fbb1e9915d41dd0094ecb358e8b40db060b67ff17673cb773b4bbae0fbcbcb936ccd184b508ee4144423772906bd39e8a87080f77a90cc
SSDEEP 192:te+2n4D13A13u13913513e13s13z1DXe1exeMeiM3E3h3rD3H26hb3PD5heweWe7:teNAe1exeMe47eweWeG5eDeQeE
TLSH
T12A521303A3B9B35A3490D6ACD252BF554B2DB07A25412AB0B79515D8E2058F7CFCFEC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260605092327_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605092327_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 35b602fa7416d19638a17259f995c0bb6d6dd1d3efb714dbbd3bfc6c5f3c53f3
MD5 750057bbcf82e9de1731edc4f0151d82
SHA1 b138e448939657a766a5f7a869f829af76d89329
SHA512 35ab4da177b64a3330a7f54c87bf2d45061f9ca3a8207450845fa0da463452b6ae36185020941796089b6c726b2297f0f43a44e6fe92305b59dcf028a95e19b1
TLSH
T1A841DF9A1EF40904B1B2E7079EF3C4535E73BCD3A834CF0C22C48369466BD01686E7A6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260605092321.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092321.log
Size 3KB
SHA256 55ec563635d0541d06d2cb01e6499d9a6fb79998e90af4e172407b356a9bb400
MD5 c13da3ec2828dd1b7943783281b0eb92
SHA1 3f964ad1942a00eb0b467901be21b506f1437794
SHA512 81c4c4648ef8143036d65d81f4150986810593a8ce7d71eac2ccb77514c0ba41846ed0012b4ed87d3f096e929fa7f92ebb0a1d5e6b8db1f8e282c53b82bdfc58
TLSH
T19B81444399D9B2993DC0E09ED650BBE96F3D701C3A4233F0F19551A88242CA89F7FE45
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260605092321_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092321_000_vcRuntimeAdditional_x86.log
Size 3KB
SHA256 3128e50039abe0acbeca73770f0b5d0ccdb79b5e84455809a617d8fca9954470
MD5 8e096989e6edd10363f92ff45c6f0fe8
SHA1 06247e2cdbb8d16fbeefb5c8234d490d657894ea
SHA512 71107d0d7e31a650f9f87c4a31b18652c8c5b859f618014d6c9ede0efa97ecc60933b61f9da9c1f4cbf4aa3fc38ce1626fe019c6733289fbe334bf9a6cf8fea9
TLSH
T13B510B1A1ED91C95A1B69707AFF3C0225A73FCD168749B0C33C5831A06AFD096C687EE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260605092325.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092325.log
Size 13KB
SHA256 249635a5851e7980b3442c68436e7a9ae9ff67ab9fee5b1f972e8fc3ca93a656
MD5 cbe053e38ced8913ef64c40c3a606f14
SHA1 2b694271e8fecadc244c14116d10cc3b3e159078
SHA512 774a42b5d7cda57e3af8b7d4b1646e1a183a02cc6a7199f100778e575dc1e67f2d3c4fd7803f4cc56a2be340a4a305feddb04fc628f122e668a5cfcc2682e0be
SSDEEP 192:qEzTnr1T1Z1+1O1d1j1g1DEKEEExEy22k0mEDEvECuaE+EHEy:qEPcEKEEExEPEDEvECXE+EHEy
TLSH
T13C5224032599F99B38D5C694F32A776D4B3A702D770106FCBBA851EDD2048B4CB4ACC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260605092325_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092325_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 0015d8d568f9e52a6fef2c3c1dd376ef5d23297cb6b242f1afdcf451c8e703be
MD5 601e6de2abe577541127d4a5bfbe0044
SHA1 f42fd9beeb56026177be9e850a7e17f1ed3d53cf
SHA512 38b40d9fe6d067a57f1610b0f995ac0be190eb27a7a453dc201e010625a1320116b9d18aa6f57fcf9023127218ed0f1cb4a075447f45faba787285d71051d153
TLSH
T12541E06A2FE41915B1B3E707E9F3C0124E73BDD2A8349F0C23C4C359066BE0669687A6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260605092325_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605092325_001_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 a4ba21d64144a0a1df45fabb64cd8ecb28a86c9f4759fcf3422b0a86b5c597cd
MD5 c4b78edcd3c2617ff6e80a4d3f4b3516
SHA1 97048e7c26a1b7a278787308bf75685368ea46b7
SHA512 ecb19ebf8c96d479ac6a060e886727cee9313ee7e57778cf59e83973b35a1b9c868379683acc9f09107c7e4e54620928e69ecd239eaa35e59f3217310f3092ae
TLSH
T17B412A6A2FE50805B1B35707EEF3C0925E33BDC278359F0D32C48359466BE056CA87A6
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 222B
SHA256 ddc0a091d65798ecbb317d6abb858688401ff19968dfa4e69c5587071ce97213
MD5 b985df7b76829d90d86defc99e1724b9
SHA1 3be9c28fcefe5ce7180e2c689211d6a7310f5bd8
SHA512 95a87a12d5ea09aea8b0af3f909c30e7e8474bcf922507f9d417f9960711ad077521314390da39d572e97c755f7bfda26168237a82d01cee5474325948f764a4
TLSH
T1D3D0A70555304015F6716141061F45083BB89B2A2193870586CDD880323B9CB805D68F
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 444B
SHA256 1b38397ee8c0f23a6b7f72182fd383f194de7d878774e141c53823f85fd03384
MD5 19715d0a74db92af24e0f0cab9017415
SHA1 aec0baa6c50997197a7fc94bed6353560b7602bb
SHA512 a75a10bab701f2ed33f801a5201f12dfbb1cdf82bfd6e7d9747e99af659ac464735c74b7b6a4a11b5516a3cec4fa853081802337fa45e821d990c3be474fbf36
TLSH
T1CFF0E50265704026FAB1A241072F89083FB8D72A21D38B09A5CDD980333BDCBC4AD3DF
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 984B
SHA256 62248ef42618154e8527372789879f3448709017b63993ee75d1776c7a9c8216
MD5 5a83a0d789ed6f02421d44bdccd87cd3
SHA1 152fbeffaeac96dea12cdffc8b55e76502f4358a
SHA512 c5cb0eebecfdfe4bde5144155e3f4fde77b468e674d3f3eb22a9c1a1e8a4dc208701e4a88515dfcff0d794e68e7f0ae083bc49ed2fdf652d390d1d16cca28886
TLSH
T17211D69255244152B9B321000B2749612FB59F2A31D7CA1A45C9D9A3772BFCFC4AD38F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
MD5 826ab855bf3d4cfbe442e5c29341c742
SHA1 0f76eaef902a256221ca8d309b46e480113669b9
SHA512 d053526e1ec45b6667699689e80ff30237a860dfa35bfdbef2885d8c525e47b3886fa17e3ae2b35e69601305ef450ccea60dc85e6023cf0ea3e20777a26ddb02
TLSH
T1D0F0E28696214016FAF322100B1B49553BB5DA2731E6CB0940C8D9A37627ACF84AD29F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
MD5 89d42ed52b434f87f3408bf635d31183
SHA1 152a56d81427313371addead21536d631fc8c7fb
SHA512 392c0c0b574b88b790a35dc4c295723f14e5a02b0fb8e8705ae767131312fc9aee7fa41411f808a35c6408b8932b8d920020092f9ac518542da0fa5d30d356c0
TLSH
T13A01F58656214017FAB322100A2B49642FB99B2731D7CB0A11CCE9937617ACFC4AC29F
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba2\license.rtf
Size 47KB
SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
MD5 e9f84e5ef16d918faa9a5425b4b041cf
SHA1 a427f89e8dc5f1784208f6755486f8b1805f67f5
SHA512 5a2bbdf2226c5e2198e33985d71c572ed0cd22197fd39cd809a0618f6aea0e80904df3c29dd051c5e5f436f95a5b37289c9dd106ebec14e00819c6f8aa0a63e7
SSDEEP 384:MG1qH+on6IXAN79ozVzEFHAUfPKQnlLsw9AjNqEllPie5u2LMli6rGsNAYAXJqsg:MG1qHKAUfPzlLswKNqAlPHU2LQhAZq2o
TLSH
T1052364A8404253D9D34353EAEF05F048BB2BF61964E594E875BFC2BE617FE6CE122412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba2\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba2\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI232B.tmp

Path C:\Windows\Installer\MSI232B.tmp
Size 165KB
SHA256 8aa9ee293b304e3368dfde27d35538f9676f3440ec5536e58ba9fe3ff7841d68
MD5 1202b90ba913a9b5b227749967d63b57
SHA1 1817119db41ec35139aed53440f3417969799d64
SHA512 851d9163caa5efcd1490d55f8238c7c338ffc3ced17021847406a1890f467a60efab4e19549aaaa82ee809ea46f882d1eaed8913d759b7e675e2e99bb3a7496b
SSDEEP 3072:igN6wMs19DGwTUxlwZRlKCCDjshYsnY0T5aPX/lfgQyVqkHKBFdI:ihwMMDjTUsxKCCDjzsn98/Bly7MHI
TLSH
T151F3F78173E80079F5B3E678DAF54656AB7378429B39E3DF0250426E0E72BD0AD35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2D0.tmp

Path C:\Windows\Installer\MSI2D0.tmp
Size 83KB
SHA256 ff95ea08d4eb2a9879c839179b0a0bf223268afe84430f23582208c814ee19a1
MD5 08895ffbb06b9e35893a77b8d613bc53
SHA1 8826feda89dc5905d6c327aed3aa839a510b96be
SHA512 fe213b0050b9346b6c7a8583be988870e7442c64407fbbd98d952653e206037c108780dea9f0ea9c51346d021935231a774b040ecccaa6123869e6318517b1b9
SSDEEP 1536:aChZ5oVlwKpAQOxQ+/hvFTTMJ0vR2JeLEUTXFTk2y3OI:vhZ5oVlSxLvFTb0JHUTXFT3y3
TLSH
T150838E2275A4C17AD0AB5976A539C1711F7EB0301BB0C88B7B560BAE9E31281B7B7317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8BA.tmp

Path C:\Windows\Installer\MSI8BA.tmp
Size 97KB
SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1 a520426523be085ec67291241f4219ab13f4d4b8
SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
TLSH
T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIECF3.tmp

Path C:\Windows\Installer\MSIECF3.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF475.tmp

Path C:\Windows\Installer\MSIF475.tmp
Size 80KB
SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
MD5 393da89078925f78e19445882c37fc59
SHA1 1313f4e6c62670f1b10aaec77c105be275f50121
SHA512 aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
SSDEEP 1536:d+/OTT4YIb6rkCGoNGXbGKauVj4eKtHa/cJg95k:4OTMYRradauqCcJg95k
TLSH
T1AC832A2179E1C231E8E2777406FCA6622D7D78B14778D4CB778842ED8AA17C09B39367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF61.tmp

Path C:\Windows\Installer\MSIF61.tmp
Size 93KB
SHA256 fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
MD5 186694813c3d5e33202a1a72c5079cc3
SHA1 90a9c2bf6419be6f46999e137c2149feca62cd13
SHA512 57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b
SSDEEP 1536:NOTekneIYoT5jmIN0gaD4Prbde67Z9AlIZzxIgU9rHUD:NOTekSoT5jr0BDKEawIZzx3U9oD
TLSH
T16F934B4523E840B6E5B7927CC9F69A06E772B4411739A3CF1174829E1F63BC49E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 157KB
SHA256 beb395d2c16c0d593221a2cefd0d5bce4a99fdeb0543b00c5a7ffef3b1e886ef
MD5 407de5f06b0d7e99ade5bf9da2c70f46
SHA1 bce5cb7686de4080587d7b700e0547df50152dff
SHA512 7e65cbed265d0a80e7a153ea5b009a8def607a78e29e8698f503710bbcac8dfb2406b12dcc0beb9e2ba53f89763419658dd759248ee7ff15d8fe02706108dad4
SSDEEP 1536:SgEjIOPe+9CeuBDpGa6KwZEYSSyOSd5ze2mmmUm+YSpJVHSGyf02KSkqnmEi0Oah:0l8pw
TLSH
T1B4F3EF19241E51F51D6227821E8D3BC7A7CF47863BE80999B274BA3CEB4784F43359E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
Size 148KB
SHA256 1b8d0e3c871b262513e08070626bf75f467ff3fd9cb99b503bd0777fd0a58efb
MD5 51a66b6238dc3d15503a82d21f101684
SHA1 bbc592d213cdadccaa4d8401918b73bd31b5115e
SHA512 fae6785e64aabe2d71de8de1e263911b204fd89bb01559a99dd5d4282b61c1c3f417b6cfcdef4ed16988c66432f307000d91f146f3d17ab11012ba8414ebdbb7
SSDEEP 1536:Rqyz2xs+S9SKSyBSVcuGrGH1GCGH2+6QaeqYCdMeCAARakoJeyQylYaxUrea2f+e:mtEuc6b
TLSH
T1ADE3D419201E51F51D626782168C378BF3DF4F852BE8096DF964BA2CEB8744F83359E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{BCEC5B87-FB7C-44F3-A147-4999E172DF36}\.ba\3082\license.rtf
Size 10KB
SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
MD5 873a413d23f830d3e87dab3b94153e08
SHA1 24cfc24f22cef89818718a86f55f27606eb42668
SHA512 dc1eccb5cc4d3047401e2bc31f5eb3e21c7881c02744a2e63c10d3c911d1158dcfac023988e873c33dc381c989304fe1d3cb27ed99d7801285c4c378553cd821
SSDEEP 192:HalhwTwQ4yzePBrarlvTteQH3bf9WaoXUBXZRaS9YARl0hcXNVD32:6lc4krlU2ymLN12
TLSH
T1C922C47016D583D003A323934693C457F6AE23E6CC29E8A87CDE9B7C20C99ECE2565DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{BCEC5B87-FB7C-44F3-A147-4999E172DF36}\.ba\3082\thm.wxl
Size 3KB
SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
MD5 47f9f8d342c9c22d0c9636bc7362fa8f
SHA1 3922d1589e284ce76ab39800e2b064f71123c1c5
SHA512 e458df875e9b0622aebe3c1449868aa6a2826a1f851db71165a872b2897cf870ccf85046944ff51ffc13bb15e54e9d9424ec36caf5a2f38ce8b7d6dc0e9b2363
TLSH
T14861E16738CF5B9079735018F8C2953A5810C4A8623B9DF1FE87495783CA9665333F63
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{BCEC5B87-FB7C-44F3-A147-4999E172DF36}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{D0921231-446F-433A-88BD-A44B91739304}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\08AU4AEI\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Size 65KB
SHA256 12b2e3ab66fa23e2814d937bc24aae3591516e61c667ced481f66a3d55b66a4c
MD5 dd97df24a39663be2d217fbb4bddffd0
SHA1 9ac8d23ec7c8655ae5bb5a62eda61871030b2a4e
SHA512 f0de89568b550f23b60fb4b343682e7b4ffeab9c571127376815d22cbb3b93a2c6081831a24c7fde7977008a72ae4395313202af39e95095d2c3d8360bfdbbb9
SSDEEP 1536:4c7HHzMKpyGZ3Jr249XJqZqSbGJyBeMczZ1:4c7HHzMDG5JdJqZqGGcBC11
TLSH
T1A6632924D3FC4723D2FB87B468F188839A75F7836DA9DB5C1485532A08577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.dll

Path C:\Windows\assembly\tmp\1BYLN3AM\Microsoft.VisualStudio.Tools.Office.Runtime.dll
Size 393KB
SHA256 2bcd529d5c2edf88d3b658816d72d1207df773ffbe805e7b5070802782c23c67
MD5 8640c74199160c6e932a5f55cac9d9c8
SHA1 661d08a2ca504c0e056bf3ddf500d9cf610ecb42
SHA512 7c06470c6ac2c7bb8bdc4fdaa81c765c810208200f059fef2cf0ddb9d815fca705964fd062d187e4e189127096690ad5ae9f4a74c5ab12b486057141e3f46332
SSDEEP 12288:P1lzmzzzzfzxVzzdqzzzzHUzJz8gXUAaBn:NlzmzzzzfzxVzzdqzzzzHUzJz8gEAa5
TLSH
T17184E62073F94218E9B70B31ECBA41C51B76BE67BE15CA1F2445315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.dll

Path C:\Windows\assembly\tmp\2DGBO5P1\Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Size 84KB
SHA256 cd56f6c0e64ea02f2a76c880a55721929dd7a2d9eced52b82122618dc2b34c18
MD5 1150e66eaca3d36ef28a7551337b6ac6
SHA1 ad37ef180a8d1c81cbdf1595bdc802ba070cb03a
SHA512 a2862ac8fd62d4261427c2217d9c02d8df5dd7f4d3a0db0bd826421050d6ef8e39e8f630f079622905dc343e16f42c1d80724e1d4132d4c9d068f089d50084c6
SSDEEP 1536:nb4VV8XW/Og9NCJ7qBEPzm42yEAWQ0yBexjzQEsC:n2dWqQmyz1LBUjk8
TLSH
T1E383195587FC4716E6B74B70F9F78447AA33F967AA23C78D1408824E2851BA4C4E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.Implementation.dll

Path C:\Windows\assembly\tmp\2YU57IFV\Microsoft.Office.Tools.Word.Implementation.dll
Size 337KB
SHA256 2585cc5fcf73680a5124d8e0a08a27d311ba903cd7bbffee7adbbf8d188c5f28
MD5 87d634d0fd6f8e13b0141730916d78a9
SHA1 8591e58967be097ab8f711395ec0b55f72d902d6
SHA512 cf0445d2d697f256d3421ee480eca5ad83d3c897c8477fd30828def534b2a45b72f5dd0e177dedad61283d28211707d7eec3661306b3c504203ac36beca377d6
SSDEEP 6144:FtlRAWy0iDCyVMvUYKZ+JICHNyPOc9Yh9g:FdXyyuMvQZ+/rc969g
TLSH
T14B741B154268C32BD5E8C235BCB136124BBDF293BEE39B2B613695A81CD37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.dll

Path C:\Windows\assembly\tmp\B3CAIFU9\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Size 78KB
SHA256 6ca890e728f1bffe2cdc670938d9c17729903f9eaade142775954ee5129b78b2
MD5 8ca4448d8a87d4edc29064678840a65b
SHA1 389ee39f6060e9b31a379e65d3c998a3dbe83b40
SHA512 b86efff7aff40a0d2750d6c4db6ed7095eb942720b972350f8cc87dcf3c666b09865befe885a57058eaa1e7aa3c5c56119324a445eabe246f52d236fff834483
SSDEEP 1536:yskby0ayhkM+TeVCB5+G9cTvdQc1bqMsDNb//pasgNiiHyBeljzQz:yDbyihcwqHba3NbSB8jkz
TLSH
T19673081497BA4FA7C2BA4378ACF1424256B5F403AB52CB6F18855F481C73B94CD13BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll

Path C:\Windows\assembly\tmp\EFRVGZEI\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Size 27KB
SHA256 eb5162b64d9b6220aacaea4eaa597bdd02880b841db717e4bdca5d64e453b4b5
MD5 e7f28e9b4375963610ea0c6b7cfa09b8
SHA1 0f2157b7bd33fa24a7ba4274c9e5aa05c88a36fa
SHA512 c683d2faefffc02e73d500b40eb91a6055b0582ed16230c47c8030a4b5f8533f075354fb427faca1fcaec6b158ecd015ddbd481033159c2b43a40339a53f163f
SSDEEP 384:rd3K6a/IZa1fKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CdWbspWLsLBiHRN72f:rd33qo6rqnL56yBeucts89z+1
TLSH
T175C25328D7F84312E2B35BB09DF5C487AC76BA53AE35C79C1586530D08227858963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.Implementation.dll

Path C:\Windows\assembly\tmp\F44935AS\Microsoft.Office.Tools.Excel.Implementation.dll
Size 459KB
SHA256 1e9f1d847daaf224c7b1ca265ecb7bc293b0df70b3a299b5da3bdb2978bc7df5
MD5 2c93d41b14f129c61d2993baaf2e002f
SHA1 96e54e9b760391683eb617baf03aa444d124472a
SHA512 21808de680825d1a1a2cd003bd5b479c2ae725e54071ebe4e8aff5b0fb000ffea3eba1ece98631ab3065a8cf6c2786c1d9059712931e2fba0410c7a2b53e31d5
SSDEEP 6144:y6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNiuNfVdKy9:y6jwRSvQh42RNjN6AVdKy9
TLSH
T12CA43C12C269D33EC2AE833750A226155BA5B2EFBAF1EF57A013C5E82C537C09D41E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.dll

Path C:\Windows\assembly\tmp\F45ZCUYA\Microsoft.Office.Tools.Outlook.dll
Size 58KB
SHA256 89d6f51dbcddb10ea2c4e92e6360e9fc2c917cd8d9f1aa162d6a47f7e940d899
MD5 6c7bc83cf1080985bb2505ed9c090c86
SHA1 64fcb206e3280b935c786d72ba34ad854bf74c7e
SHA512 8b2a1d334f01e7997bb6b5c7752d9a275714b811ebb293e95bd9b1be7d2bb44484998ab1fc1845fb7e6f4df4613082fa4ed552a4994961fe611a92b93e0ca9e3
SSDEEP 768:jRXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24nbxocNAwkEGjhl2BOBaBnD/sxFsN/4:SSk2HQq9D4bg3yBeOkmVzpqZ
TLSH
T1BF43A382920A96D6CC55A5742A70FB52E63EF3FB1BD0B65F8813DCF408A3250E905F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\GFHE3QJ5\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Size 360KB
SHA256 25e23e4bc78db831a05fad7dc758354a932278b42b1b7277b62a75c717e89edf
MD5 5cb69e557b5b117597246c9e67cfdc8c
SHA1 f36af240ff34cc7c11c6ae1f0d67a0abf1496576
SHA512 9af38e10fa70186abf4088e86a9b45b79b4e6a41d20348f56da07fd8415ebf5d3695b8ef41962bb39310f5dd3436c2cbe70ba3982c720d7beb7b80b5ac6b1616
SSDEEP 3072:RyWCQQzXgPice1NvAbugFh/jLqthte2Seh66LikrKwQp91sq9kAatVrmCK2phJRS:UWCdDiyvgmiL54AaXDBP8v
TLSH
T1B174D62073F95208E9B70B30AC7692C51A76BE677E15C62F2449314D6AB2B53CB23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.dll

Path C:\Windows\assembly\tmp\HIC95ELH\Microsoft.Office.Tools.Excel.dll
Size 171KB
SHA256 a4397784c26adfec3393dc421d27f826099a19f1d55b64a2e6199d977a37515a
MD5 acf3804fead07de2fc137e95a57494ec
SHA1 d8b82e20db36ebf1dd2b27d8f301e59c0fc62565
SHA512 e21e42e012a0599f99c812ce4cb520d9219ddda15fe5c05241b6aeb17d0df4103877c81877a75b55271b389fc12c2ad822c2e4ec8e72a750d17b8e22829c3736
SSDEEP 3072:VWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vamSxBAZirZANBtJ:VnMr8CSQ09ap6Jy65Rm2v22v
TLSH
T1730419C1AB0BE061DCC9563C38AA7B056F3CFBD295D2EB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.dll

Path C:\Windows\assembly\tmp\HXV36WK9\Microsoft.Office.Tools.Word.dll
Size 142KB
SHA256 bf5406b6657cc7aca2db714ec375efc3ffdf4cc32a80f938b3dfa502ebdd26f9
MD5 b24ae31036dc11fe6239397a22e8c659
SHA1 40d2739f8d2c19db095db4ef4f1a9cb6bae7880e
SHA512 c713095f297a37458edba5f9bbd6e04e9407089b3f8e98f9c3c52e9711a8be01a3e7268ece3837d1e0438588c50406eacf7afa5bab08d2ceba68dde76ea27915
SSDEEP 3072:jrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO8+rCo7VBpdfh:jrwBZWkge7DuV/7Tfh
TLSH
T1C3E34A91EA35C259CE84C47D3E21BB00DB3CF3D644C2A79F4526FCE80A9B791C552E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\IXVCAHZX\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Size 38KB
SHA256 d182d18bbf9526dd0eb821eabddc885b80ba8f6dde2c9e0bb809fb55c14c7c47
MD5 32c152242c691677b866356014498d2d
SHA1 fc75591a894f0e8b5aecbd0bd13e3184df0c4f38
SHA512 bdf69a1b755f176e958f6d4c4e2e7c3ae74000a43266873ba602436c089983d0ebcf6e26344a15d8b2001ae74a798b5dacdbdd7cbc206426783704b036e05831
SSDEEP 384:bKQOJrYa7mdessomj5R/yeizfa19crXKJ9Yu6dnPU3SERztmCJMadMardz/JikPF:OQOVYoxVUq+w6rqnzxAzpL5yBeL19ze
TLSH
T15A03D628C3FC8326EAB347B0E9F5D4876937B553AE75D7AC1589630D18227848523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v4.0.Framework.dll

Path C:\Windows\assembly\tmp\JGF388II\Microsoft.Office.Tools.v4.0.Framework.dll
Size 30KB
SHA256 8b1af886189a4f9610d1e38aca9d71cfd137e0ecb326d7c46cae9264c3faf097
MD5 7fdb0de95e06f278b3a08581f25a435e
SHA1 f7b03fcd3c6d8c4dd1e65a689a73acbfe5c2a3ee
SHA512 8a289b9c4c82c3d8c22bfdaf57aa0416de14f6bcb22e9a3e10630fc158c65c48fa012a8946423950a65722fcdd0f3c643fee116ad848bd802aed4347a973c19e
SSDEEP 768:aHaVFSvPSNEtyJvrpc49qFkByBehN99zeXDF:Y29rQFkByBehxz8DF
TLSH
T19FE2185087FC136BE9AB0A707EE5D8815D3AFF526D62E21F4058C05E14F5BE4CA62327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll

Path C:\Windows\assembly\tmp\KOYS0E2E\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Size 134KB
SHA256 df0deac24f6371b26da9f34c1ce21e7d3fb7e4a4d75c42745c265b4639cb3e82
MD5 d8d3a7296bfe05f2355f96f526f1dce7
SHA1 f1ec56517cce54f75fc3b8cb3f82f901cb3d96af
SHA512 67f3816e595f472f3d67983e7207cbd643a2ccc3f6187bd94f2ca32dc2cfac3fb7daee7b5b05aa8ce46d829b99687cdfa4f34e802835b90955b126cfabadff48
SSDEEP 3072:ON1zvAuFvVyV2sUz8mqc9AaZiNhxm0bBzC:OTv5tAaKWQe
TLSH
T186D3D41B93FC0269F2B70B70EDBE94CA5877BD566C21D25F044A764E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.Implementation.dll

Path C:\Windows\assembly\tmp\M4L4M6SV\Microsoft.Office.Tools.Common.Implementation.dll
Size 354KB
SHA256 1bc4ff4e9cc85d9457e80276354f643028c01c25414d0e81450bb52ed802e93c
MD5 00ee8a57705bf407a2fa0606b144a13c
SHA1 3c9a6ed3cdb6d167da2ac38518c3820985e4b6b0
SHA512 9197e0ce0e8979b7d8c8e5b95ef5b9bf22fe8cc803b26c97b3c44d1d9e095f85a2a205eaa57152a9843b8fdb7751bdbc1e64cb3f3f04d3952537428cb427fc93
SSDEEP 6144:iNeM8oM6s8alZ+afj5OAKOQ4pUE9wttHqr:O9QZ3j5IOQ4pUE9wttKr
TLSH
T18874A415A3FE5761E2F70B34ACB40489DAB6FD479E6A974F2445A14E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll

Path C:\Windows\assembly\tmp\P8IM6CR4\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Size 192KB
SHA256 e51a6c5e34b5e1ac743fca62a8c8d82f3e5099914745664a23843f6276e89039
MD5 91cc9825305d8554054d097b5418d7fd
SHA1 750eda13cddadf3f38de3df25062cc4774e019cd
SHA512 c1c82bd4859e0db7763f6e11425eb02270cec54ce79c0f848e1be5cab2c1715b7e9a96f12d9d2f11d5418881596837b3fbf84254be9e77e84b01a2b11c646802
SSDEEP 3072:0cs+QnXsia21rUBJeImxRGluQriZY+/ZCX/kMrICBX0a:0csrRIHiBtkb
TLSH
T1F3142A2467FC1B15F2FB0B7AEDB5A0019A76FE662913D31D15A0419E1872F80CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.dll

Path C:\Windows\assembly\tmp\PE519KF3\Microsoft.Office.Tools.Common.dll
Size 93KB
SHA256 1f9e5b3df61e6ae400905e38ef3e3c8208698a488305554dbe9293887ffa6478
MD5 d75541051253a7528d7c14d60fdb3e27
SHA1 e03b4457b01aaee52fb01967a781d10001c6329e
SHA512 5399fdd80de5492ba106c8b29d87d4a6ab0ac329ab1f882c13662a1807b86dee5c2fb667ffd39b87d664b0baeaaa30738aae7b516e048a0f606abc01a9647cce
SSDEEP 1536:ey+zGztUjm2oNIv5oiIZZB8CFD4W8yBeNzfzx9:tzhNw5yjVDB0bl9
TLSH
T1CB930626A23684BDDDC9103C74983531A73CF3B78246A7871909BDAA4DD3BCBC987749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll

Path C:\Windows\assembly\tmp\QPT164JD\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Size 64KB
SHA256 e36435590e80c1d27493fbb9cc2f7a402fb3207e7210d134233099d1c01cbe8c
MD5 64939e920a0619adb8e395877237b560
SHA1 c05ecc9674f7a9436a227da429b474910a163d9d
SHA512 05281db2372f72aa9ab44ac3dab79a3e506390ac6b317180273a32d6a4f82f36128b75ad7e706333dfe318766e21ec8f42a72e55b875faf86e152d4d592b624e
SSDEEP 1536:ZZan8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsmjhGBDypyBeQjzQC:lMPG7wqLDy8BtjkC
TLSH
T1F6532A2893F84723D6FF83B8B9F191435A76F543AE61CB6E18CA938908533D4491376B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll

Path C:\Windows\assembly\tmp\R6QO0ZV9\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Size 155KB
SHA256 ac12705a2b9470ef07732f500bcd8b2844282be1f609f5aa74b0dd3f0268362b
MD5 7a17537e156d75e293aa693423fd0fd6
SHA1 2bafdfe9348c0a39dbfdca35d7a04d925bdc82a0
SHA512 ab38de8c226a7361d0b1d2adb3929585ebc214ea0b967e7f851891f4c2c451030fa38cd8c3978f881ccb90339e40272c0522aaffae8073e9a4c3467eb3118fa6
SSDEEP 3072:i0anyn/CiBk6HOIz42IJqFF/0/QAWwTrjeK4BED:2n+VEn08
TLSH
T108F32A5A63EC0716F6FB0731A8FA54416EBAF8132962CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.dll

Path C:\Windows\assembly\tmp\RJRQCY6Z\Microsoft.Office.Tools.dll
Size 18KB
SHA256 02d0d460ec66aca17204ef8f7244e2e34e117c7f20aa07e98cb83a1386a1146f
MD5 c7af388d0d92544cbc307cc692f6dc1c
SHA1 660b07bf79682e91b23824fa327950bfa8c73f01
SHA512 5a8d81ed8fce9eac5175c676f7db4cc147f4f2999cc9e010de4bf87c79bd106c45d0c8848f1cb0eb61a7ad7cf33d2d4881f9cce588cce4d841bcaa66ec8f187e
SSDEEP 384:H1LtwmrH+WAnmkW/MwWVsLBiHRN72lkPtHNsAR9zkwm/:H19AZvyBe6kFts89zni
TLSH
T192922A55D7DF8EA3CC622C709DF4D7423E3CA7835D12DA2B0689E5192CB3394C521729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.dll

Path C:\Windows\assembly\tmp\RMO130V2\Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Size 204KB
SHA256 ed512630534121de6e87259230aa7d67547b810bbe54757b561c9cd86428a316
MD5 6cf6471f917d139fa7f6b57a09156a8b
SHA1 896f482ed5892beed0cf3d74cfd599c2980d485b
SHA512 2192f731aaba560bb91e85ca5282943dc7c4bfde708690808487cb966c1051ead73f63a71f75cf52d7fcfd9141fb82c3f2d1edebaf21ee87601aa5deeca82cc1
SSDEEP 3072:00uKb2fEejyG2iPklibcruOVTzk21wxqWX58Kn8p6/A/C9hSrBbQ3t4N3BMjkf:b8cXqcfDKQCGP
TLSH
T1F6144B5663FC0726F6BB0B35D4FB11026E76F8172A53DB0C688A469E1971B808A73737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll

Path C:\Windows\assembly\tmp\RSENPKOO\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Size 200KB
SHA256 0f5b5e40b8a1708051250bbc9e36ba35357312503beb0004ae6a2cc5a20466e8
MD5 9828dbd687c6ac093d40dfd61de68a0e
SHA1 9c96f865e83d7deae884321e76c87553c6088748
SHA512 001852557d9bbc33cb9b274277d2e24b63b1d46b253674f13eda857f36bf0718779242621c14809f902df041283c8302164d584a4e42be3ed11a0cef591f7853
SSDEEP 3072:SrFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirP+R/x3zKFvlBz1:SrFAoOXcHfIfiKkvx
TLSH
T11C142910A7FD1B25F6FB4B79EDB6A0018A36FA263D13D31D15A0419E1876B40CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.Implementation.dll

Path C:\Windows\assembly\tmp\T9Z5ITFA\Microsoft.Office.Tools.Outlook.Implementation.dll
Size 140KB
SHA256 326bdb32503351a9b99fe69eb884a5a02d4bff0ff2c7b8b3ce9674fab9fcfc31
MD5 0f7bc383c04833cfd5e6d6f6d5b9f9c7
SHA1 29f672f4c8dfb820e42b54a9924e93ede94481aa
SHA512 d3a7b278a7244c13a887d2a50b8aee39af38fa8dc02f7566a3c9b6e02f25415e2e009cc118d923d22c55c223961657d832a445f897adb4a5649d70e9e9cd2d8f
SSDEEP 1536:oBjLPfRUqxc0O/t4DErSu9e7EMaggaqRuDPR6TCZByBe9zi:oBfPJUqxy14DEF9e7D3gaqR4PGIEBi2
TLSH
T147E31B00A3AA0B92D07555341BF2B542EA3DFBA72AD5E75F5411CED80CB3B90DC22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\Z894JAPU\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Size 44KB
SHA256 436215d03a6cd3b30d6b2e7006aa4a83f7c3291f3fc0b4ad86ff55e70dac8650
MD5 1190dedce8f1b97816123163216dd096
SHA1 468d499041ab141f4233b23d53ffb9a203cfda35
SHA512 fe35ddd5a4a600cf840414f8859691f5894ee779517f3b069f97667e68f6cae54836d393091f828dc9541c6fd9dbac4a77fd53eb3840a8d3dfda8d21373fa710
SSDEEP 384:MBk39BmxOVst4SCtrpuXYa1pbr/0K7yEKJ9Yu6dnPU3SERztmCJMadMardz/Jiks:MGfZs5CZqlj26rqnuMztgyBepmoQ9zpG
TLSH
T14713D769D3F84712D6F74BB06DF1E4435936BA539EA8DB5C145A530A08233D88E22F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\ZNBS1582\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Size 38KB
SHA256 b2673e6faf166a80f9f3832234508d25f3d219eafb6ba1d8d16583aff3517793
MD5 792d885a3d06f829956b3f0461789f4f
SHA1 f5d023f2dfcfb369bfeed2815da8c1ca54a948f4
SHA512 55e82a9ac9a9bf8a3f3dfbe4e529629a11a1df48774874509b71e062d7f754178b3a87f49d8d46580cf3aa9af52ba03747c980c8422456538d6c52102f1ce24d
SSDEEP 384:Tght+fMtSM9jmxa1CFbdKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3HW88NWXsY:TgX+EtkqP6rqnGKKyBez69zo
TLSH
T18603B629D7F84312E2F747B09CF584837976FA53AE38DB6C15C5934948237848A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_000_vcRuntimeMinimum_x86.log

Path C:\Windows\system32\dd_vcredist_x86_000_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 3afb3534ba7a3714d9bc6a11443d4d9b45f7a66a2d1fb397e27f3c1a6dd0eb72
MD5 d448052fac5a7caf11b1161881e63dde
SHA1 63223bb64104caa064f2e0d3f7e5f34b3257693e
SHA512 0155969f969c53ccf4dde094cfbe5714c366344478e4f1b56ad0ec521a4e290235529b71d58ef15066b3779126543877edd1793bc72335015f9e6e1506cf2b33
TLSH
T1334105551EE41848B1B25757EAF3C0525E33FCD36834EF0C3385832A066BE095CA87AA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/956-1743-0x0000000000AC0000-0x0000000000B25000-memory.dmp

Download

memory/1036-1657-0x0000000000740000-0x000000000079E000-memory.dmp

Download

memory/1144-2117-0x00000000000C0000-0x0000000000137000-memory.dmp

Download

memory/1376-1744-0x0000000000AC0000-0x0000000000B25000-memory.dmp

Download

memory/1976-2042-0x0000000000590000-0x00000000005F5000-memory.dmp

Download

memory/2012-2074-0x0000000000AC0000-0x0000000000B25000-memory.dmp

Download

memory/2168-2044-0x0000000000590000-0x00000000005F5000-memory.dmp

Download

memory/2180-2245-0x0000000000C60000-0x0000000000CD7000-memory.dmp

Download

memory/2380-1903-0x0000000000740000-0x000000000079E000-memory.dmp

Download

memory/2412-3425-0x000000001C920000-0x000000001C938000-memory.dmp

Download

memory/2412-3420-0x000000001C940000-0x000000001C94E000-memory.dmp

Download

memory/2412-3424-0x000000001C940000-0x000000001C94E000-memory.dmp

Download

memory/2412-3422-0x000000001CA10000-0x000000001CA26000-memory.dmp

Download

memory/2412-3428-0x000000001D730000-0x000000001DA42000-memory.dmp

Download

memory/2412-3423-0x000000001C9F0000-0x000000001C9FE000-memory.dmp

Download

memory/2412-3426-0x000000001C9E0000-0x000000001C9FA000-memory.dmp

Download

memory/2412-3427-0x000000001D260000-0x000000001D72E000-memory.dmp

Download

memory/2412-3431-0x000000001CDF0000-0x000000001CE98000-memory.dmp

Download

memory/2412-3430-0x0000000001620000-0x000000000162C000-memory.dmp

Download

memory/2412-3421-0x000000001CD40000-0x000000001CD88000-memory.dmp

Download

memory/2412-3414-0x00000000015C0000-0x00000000015EC000-memory.dmp

Download

memory/2412-3419-0x000000001C940000-0x000000001C94E000-memory.dmp

Download

memory/2412-3415-0x0000000001490000-0x000000000149E000-memory.dmp

Download

memory/2412-3429-0x0000000001620000-0x000000000162C000-memory.dmp

Download

memory/2412-3418-0x000000001C940000-0x000000001C94A000-memory.dmp

Download

memory/2412-3417-0x000000001C940000-0x000000001C94C000-memory.dmp

Download

memory/2412-3416-0x000000001C940000-0x000000001C94A000-memory.dmp

Download

memory/2652-1847-0x00000000000C0000-0x0000000000137000-memory.dmp

Download

memory/2792-2243-0x0000000000C60000-0x0000000000CD7000-memory.dmp

Download

memory/2972-2116-0x00000000000C0000-0x0000000000137000-memory.dmp

Download

memory/3712-3063-0x0000018F32020000-0x0000018F3207C000-memory.dmp

Download

memory/3712-3042-0x0000018F30020000-0x0000018F3002A000-memory.dmp

Download

memory/3712-3133-0x0000018F30020000-0x0000018F3002C000-memory.dmp

Download

memory/3712-3140-0x0000018F30020000-0x0000018F30028000-memory.dmp

Download

memory/3712-3147-0x0000018F307E0000-0x0000018F307FC000-memory.dmp

Download

memory/3712-3154-0x0000018F30A10000-0x0000018F30A3E000-memory.dmp

Download

memory/3712-3161-0x0000018F307E0000-0x0000018F307F2000-memory.dmp

Download

memory/3712-3168-0x0000018F30A10000-0x0000018F30A38000-memory.dmp

Download

memory/3712-3175-0x0000018F31C30000-0x0000018F31C8C000-memory.dmp

Download

memory/3712-3182-0x0000018F31D50000-0x0000018F31DC6000-memory.dmp

Download

memory/3712-3189-0x0000018F30A10000-0x0000018F30A36000-memory.dmp

Download

memory/3712-3196-0x0000018F31C30000-0x0000018F31C88000-memory.dmp

Download

memory/3712-3203-0x0000018F307E0000-0x0000018F307F6000-memory.dmp

Download

memory/3712-3210-0x0000018F31D50000-0x0000018F31DB6000-memory.dmp

Download

memory/3712-3217-0x0000018F30A10000-0x0000018F30A36000-memory.dmp

Download

memory/3712-3119-0x0000018F31C30000-0x0000018F31C66000-memory.dmp

Download

memory/3712-3112-0x0000018F30960000-0x0000018F30978000-memory.dmp

Download

memory/3712-3105-0x0000018F30960000-0x0000018F30974000-memory.dmp

Download

memory/3712-2919-0x0000018F307E0000-0x0000018F307EE000-memory.dmp

Download

memory/3712-3098-0x0000018F30960000-0x0000018F30974000-memory.dmp

Download

memory/3712-2916-0x0000018F30A10000-0x0000018F30A3A000-memory.dmp

Download

memory/3712-3091-0x0000018F30020000-0x0000018F3002A000-memory.dmp

Download

memory/3712-2912-0x0000018F30030000-0x0000018F3003A000-memory.dmp

Download

memory/3712-2909-0x0000018F30CD0000-0x0000018F30D04000-memory.dmp

Download

memory/3712-3084-0x0000018F30A10000-0x0000018F30A28000-memory.dmp

Download

memory/3712-3077-0x0000018F30020000-0x0000018F3002E000-memory.dmp

Download

memory/3712-2905-0x0000018F30020000-0x0000018F3002A000-memory.dmp

Download

memory/3712-3070-0x0000018F30A10000-0x0000018F30A2A000-memory.dmp

Download

memory/3712-2980-0x0000018F31E00000-0x0000018F31E28000-memory.dmp

Download

memory/3712-3056-0x0000018F32020000-0x0000018F32054000-memory.dmp

Download

memory/3712-3049-0x0000018F31DD0000-0x0000018F31DFA000-memory.dmp

Download

memory/3712-3126-0x0000018F31C30000-0x0000018F31C64000-memory.dmp

Download

memory/3712-3035-0x0000018F307E0000-0x0000018F307EE000-memory.dmp

Download

memory/3712-3028-0x0000018F307E0000-0x0000018F307EE000-memory.dmp

Download

memory/3712-3021-0x0000018F307E0000-0x0000018F307EE000-memory.dmp

Download

memory/3712-3004-0x0000018F32000000-0x0000018F32014000-memory.dmp

Download

memory/3712-3000-0x0000018F31FE0000-0x0000018F31FF4000-memory.dmp

Download

memory/3712-2996-0x0000018F30970000-0x0000018F3097E000-memory.dmp

Download

memory/3712-2992-0x0000018F30960000-0x0000018F3096E000-memory.dmp

Download

memory/3712-2923-0x0000018F31C30000-0x0000018F31C66000-memory.dmp

Download

memory/3712-2926-0x0000018F30A60000-0x0000018F30A78000-memory.dmp

Download

memory/3712-2929-0x0000018F31C70000-0x0000018F31CA4000-memory.dmp

Download

memory/3712-2932-0x0000018F31D50000-0x0000018F31DAC000-memory.dmp

Download

memory/3712-2935-0x0000018F30A80000-0x0000018F30A9C000-memory.dmp

Download

memory/3712-2977-0x0000018F31F80000-0x0000018F31FD8000-memory.dmp

Download

memory/3712-2974-0x0000018F31DB0000-0x0000018F31DCA000-memory.dmp

Download

memory/3712-2938-0x0000018F30AA0000-0x0000018F30AB6000-memory.dmp

Download

memory/3712-2941-0x0000018F307F0000-0x0000018F307F8000-memory.dmp

Download

memory/3712-2944-0x0000018F30B50000-0x0000018F30B68000-memory.dmp

Download

memory/3712-2947-0x0000018F31E30000-0x0000018F31EA6000-memory.dmp

Download

memory/3712-2950-0x0000018F31CB0000-0x0000018F31CDE000-memory.dmp

Download

memory/3712-2953-0x0000018F308B0000-0x0000018F308BE000-memory.dmp

Download

memory/3712-2971-0x0000018F30950000-0x0000018F3095C000-memory.dmp

Download

memory/3712-2968-0x0000018F31D20000-0x0000018F31D46000-memory.dmp

Download

memory/3712-2965-0x0000018F31F10000-0x0000018F31F76000-memory.dmp

Download

memory/3712-2962-0x0000018F31EB0000-0x0000018F31F0E000-memory.dmp

Download

memory/3712-2956-0x0000018F31CF0000-0x0000018F31D16000-memory.dmp

Download

memory/3712-2959-0x0000018F30D10000-0x0000018F30D22000-memory.dmp

Download

memory/3964-1846-0x00000000000C0000-0x0000000000137000-memory.dmp

Download

memory/4484-1844-0x00000000000C0000-0x0000000000137000-memory.dmp

Download

memory/4752-2244-0x0000000000C60000-0x0000000000CD7000-memory.dmp

Download

memory/5024-1904-0x0000000000740000-0x000000000079E000-memory.dmp

Download

memory/5032-2073-0x0000000000AC0000-0x0000000000B25000-memory.dmp

Download

memory/5084-1656-0x0000000000740000-0x000000000079E000-memory.dmp

Download