Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
06/06/2026, 02:42
General
- Target 2026-06-06_82a40ea2be7bdc73d196fbee0ed611de_elex_wannacry.exe
- Size 58.0MB
- Sample260606-c61s8aav8k
- SHA256 b3227fff695ca7441764e13f95173ad6a28b878c9c986aabf8b81104d42238ca
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 64 IoCs
- System Binary Proxy Execution: Rundll32 1 TTPs 8 IoCs
Abuse Rundll32 to proxy execution of malicious code.
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 10 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_82a40ea2be7bdc73d196fbee0ed611de_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-06_82a40ea2be7bdc73d196fbee0ed611de_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_82a40ea2be7bdc73d196fbee0ed611de_elex_wannacry.exePECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~4341402116270437553.tmp.exe",,"C:\Users\Admin\AppData\Local\Temp\2026-06-06_82a40ea2be7bdc73d196fbee0ed611de_elex_wannacry.exe""#102|SCRIPT"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\~~4341402116270437553.tmp.exe"C:\Users\Admin\AppData\Local\Temp\~~4341402116270437553.tmp.exe" -panhdv123456-_2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~~4341402116270437553.tmp.exe"C:\Users\Admin\AppData\Local\Temp\~~4341402116270437553.tmp.exe" -sfxwaitall:0 "dx\LaunchINFSectionEx64.exe" dx\DXeurt.inf,Passive,,83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe" dx\DXeurt.inf,Passive,,84⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\Temp\~~4341402116270437553.tmp.exe"C:\Users\Admin\AppData\Local\Temp\~~4341402116270437553.tmp.exe" -sfxwaitall:0 "dx\LaunchINFSectionEx64.exe" dx\DXmngd.inf,Passive,,83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\dx\LaunchINFSectionEx64.exe" dx\DXmngd.inf,Passive,,84⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\DirectX for Managed Code\mdxi.exe"C:\Windows\Microsoft.NET\DirectX for Managed Code\mdxi.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8A69.tmp\8A6A.tmp\8A6B.bat C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd /auto"4⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /c:" 5."5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ver5⤵
-
-
C:\Windows\System32\reg.exereg.exe query "HKU\S-1-5-19"5⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\find.exefind /i "ComputerSystem"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v productname6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex6⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled5⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled5⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4735⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.61135.4005⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40664.05⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo 14.32.35112.15⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.50727.6229"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.50727.6229"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.30729.7523"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.30729.7523"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F05⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "VC_RED_enu_"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A5⤵
-
-
C:\Windows\System32\find.exefind /i "VC_RED_enu_"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{922480B5-CAEB-4B1B-AAA4-9716EFDCE26B} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C18FB403-1E88-43C8-AD8A-CED50F23DE8B} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2022 Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable *x64" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable *x64" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable *x64" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable *x64" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable *x64" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable *x64" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable *x64" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable *x86" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable *x64" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2022 Redistributable *x64" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017-2022 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable *x64" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable *x86" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart5⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{A0AB7064-FE4C-40E4-A9CA-1152002013AD} {5F982C97-EAB5-4BA0-A734-0B55771202FE} 47406⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f5⤵
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{E248B244-72CD-4603-9245-3407E68BB3F9} {63AA1665-4AD7-4500-A227-35FCC36F42E0} 39286⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f5⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{DBC8D89C-F064-4BD0-974C-035C9978E8A4} {C293F6FC-6563-4B49-8663-06D46D196FAF} 54806⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f5⤵
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{ACC44278-A55F-475E-9954-D88F5575AF94} {80440BEE-9AB4-4CAC-AA66-8D8673D818C9} 52966⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 11687⤵
- Program crash
-
-
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f5⤵
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart5⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart6⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{6C812B0D-01EC-4F1C-8A5F-B25A14B6C3A5} {D9536242-A457-4287-8BD9-1B751A0C7611} 48327⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f5⤵
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart5⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6BFF8176-ADE8-4F3A-96E5-672D50A9B272} {53F12B5E-B5F5-4134-BA1D-A918D342537D} 60607⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\msiexec.exeMsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart5⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\msiexec.exeMsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart5⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\msiexec.exeMsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\msiexec.exeMsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"5⤵
-
C:\Windows\System32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4735⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp120.dll"5⤵
-
C:\Windows\System32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp120.dll"6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40664.05⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.50727.6229"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.50727.6229"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.30729.7523"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /v /c:"0.30729.7523"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "VC_RED_enu_"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "VC_RED_enu_"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{43B0D101-A022-48F4-9D04-BA404CEB1D53} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86AB2CC9-08BD-4643-B0F9-F82D006D72FF} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s5⤵
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s5⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "HKEY_LOCAL_MACHINE"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"5⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString5⤵
-
-
C:\Windows\System32\msiexec.exeMsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart5⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f5⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString5⤵
- Modifies registry key
-
-
C:\Windows\System32\msiexec.exeMsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart5⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" MSIFASTINSTALL=3 /qb5⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" MSIFASTINSTALL=3 /qb5⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeMinimum_x86.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeAdditional_x86.msi" MSIFASTINSTALL=3 /qb5⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\comct232.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\comct232.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\comct332.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\comct332.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\comctl32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\comctl32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\COMDLG32.OCX"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\COMDLG32.OCX"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\dbgrid32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\dbgrid32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\dblist32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\dblist32.ocx"6⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\mci32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\mci32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msadodc.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msadodc.ocx"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\mschrt20.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\mschrt20.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\mscomct2.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\mscomct2.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\MSCOMCTL.OCX"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\MSCOMCTL.OCX"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\mscomctl32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\mscomctl32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\mscomm32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\mscomm32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msdatgrd.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msdatgrd.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msdatlst.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msdatlst.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msdatrep.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msdatrep.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msflxgrd.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msflxgrd.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\mshflxgd.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\mshflxgd.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msinet.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msinet.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msmapi32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msmapi32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msmask32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msmask32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\msrdc20.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\msrdc20.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\mswinsck.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\mswinsck.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\picclp32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\picclp32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\richtx32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\richtx32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\sysinfo.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\sysinfo.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
-
-
C:\Windows\System32\regsvr32.exeregsvr32 /s "C:\Windows\syswow64\tabctl32.ocx"5⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Windows\syswow64\tabctl32.ocx"6⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2010\x64\vcred10_x64.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2012\x64\vcred11_x64.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2013\x64\vcred12_x64.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2022\x64\vcred14_x64.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
- Drops file in Windows directory
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2010\x86\vcred10_x86.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2012\x86\vcred11_x86.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
- Drops file in Windows directory
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2013\x86\vcred12_x86.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
-
-
C:\Windows\System32\rundll32.exerundll32.exe advpack.dll,LaunchINFSectionEx .\2022\x86\vcred14_x86.inf,Install,,12,N5⤵
- System Binary Proxy Execution: Rundll32
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_82a40ea2be7bdc73d196fbee0ed611de_elex_wannacry.exePECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~6250744205539790581.cmd"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SYSTEM32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\~6250744205539790581.cmd"3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 637F9945B36023F79B5990B01A4593742⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 74396BE8E23BACBD7105589A03AD591D2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C62B92880B4E75183A793CEA4BAF36812⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D521CFB915C588A7F32FB87BA458F3D02⤵
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 16DB3DD73ADE55F00798D644F16DB7C82⤵
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding C7A1CCEE6091D940314D4741B3AC13602⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 47364ED8C24053C996A49131B61503422⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 26B4CF7815B74F9F3F2761928FFAF6A62⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605224304.log" /uninstall /passive /norestart ignored /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605224304.log /uninstall /passive /norestart ignored2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605224304.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{28E3E7A2-F36C-4D82-9C39-38F001CEA6DE} {CFC01332-D819-46A5-8908-75BE49650E83} 46323⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605224306.log"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605224306.log" -burn.unelevated BurnPipe.{EF888D58-72E7-4D53-AF3F-01B7BDA872F3} {9B22EAA4-7626-404E-99D2-6E72F3B4B335} 6723⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605224308.log"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605224308.log" -burn.unelevated BurnPipe.{230AAE12-A5C7-4743-A84A-6EE421495500} {08E4935A-D49E-4C67-9BE0-19306FC05FF9} 52923⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2556 -ip 25561⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605224310.log"2⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=572 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605224310.log"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605224312.log"2⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605224312.log"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e58d6e5.rbs
e58d6f8.rbs
e58d6ff.rbs
e58d710.rbs
e58d715.rbs
e58d726.rbs
e58d737.rbs
e58d73e.rbs
e58d74f.rbs
e58d75d.rbs
e58d761.rbs
e58d785.rbf
e58d78c.rbs
e58d794.rbs
e58d798.rbs
e58d7ca.rbs
e58d7d1.rbs
e58d7d6.rbs
e58d7db.rbs
e58d7e0.rbs
e58d7e5.rbs
e58d7ea.rbs
e58d7f9.rbs
e58d7ff.rbs
e58d802.rbs
e58d806.rbs
e58d80e.rbs
e58d813.rbs
e58d81e.rbs
vc_red.msi
vc_runtimeMinimum_x64.msi
29063dx.xml
64D3DCompiler_37.dll
64D3DCompiler_38.dll
64D3DCompiler_42.dll
64X3DAudio1_4.dll
64X3DAudio1_5.dll
64X3DAudio1_6.dll
64X3DAudio1_7.dll
64d3dcompiler_33.dll
64d3dcompiler_34.dll
64d3dx10_33.dll
64d3dx9_28.dll
64d3dx9_30.dll
64d3dx9_31.dll
64d3dx9_32.dll
64d3dx9_41.dll
64d3dx9_42.dll
64d3dx9_43.dll
64xactengine2_1.dll
64xactengine2_10.dll
DXeurt.inf
LaunchINFSectionEx64.exe
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
msi.txt
msi.txt
wix.txt
logo.png
license.rtf
thm.wxl
thm.xml
wixstdba.dll
license.rtf
wixstdba.dll
~6250744205539790581.cmd
DXmngd.inf
vcred10_x64.inf
vcred10_x86.inf
vcred11_x64.inf
vcred11_x86.inf
vcred12_x64.inf
vcred12_x86.inf
vcred14_x64.inf
vcred14_x86.inf
MSI1107.tmp
MSICB3.tmp
MSIFB6D.tmp
MSIFFD1.tmp
Microsoft.DirectX.AudioVideoPlayback.dll
Microsoft.DirectX.AudioVideoPlayback.xml
Microsoft.DirectX.Diagnostics.dll
Microsoft.DirectX.Diagnostics.xml
Microsoft.DirectX.Direct3D.dll
Microsoft.DirectX.Direct3D.xml
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.DirectDraw.dll
Microsoft.DirectX.DirectDraw.xml
Microsoft.DirectX.DirectInput.dll
Microsoft.DirectX.DirectInput.xml
Microsoft.DirectX.DirectPlay.dll
Microsoft.DirectX.DirectPlay.xml
Microsoft.DirectX.DirectSound.dll
Microsoft.DirectX.DirectSound.xml
Microsoft.DirectX.dll
Microsoft.DirectX.xml
SET883C.tmp
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
Microsoft.DirectX.Direct3DX.dll
mdxi.exe
mdxu.exe
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
SET7EFE.tmp
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
X3DAudio1_7.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
XAudio2_9redist.dll
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_41.dll
d3dx9_42.dll
d3dx9_43.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_43.dll
X3DAudio1_3.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_4.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_6.dll
XAudio2_7.dll
XAudio2_9redist.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_29.dll
d3dx9_33.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_6.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
xinput1_3.dll
license.rtf
thm.xml
wixstdba.dll
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
__AssemblyInfo__.ini
memory/672-3006-0x00000000000F0000-0x0000000000155000-memory.dmp
memory/1468-2629-0x00000000004E0000-0x000000000053E000-memory.dmp
memory/1748-2915-0x0000000000690000-0x0000000000707000-memory.dmp
memory/2012-2918-0x0000000000690000-0x0000000000707000-memory.dmp
memory/2640-2805-0x0000000000FD0000-0x0000000001047000-memory.dmp
memory/2864-2913-0x00000000004E0000-0x000000000053E000-memory.dmp
memory/3192-3005-0x00000000000F0000-0x0000000000155000-memory.dmp
memory/3900-3496-0x00000259989B0000-0x0000025998A6D000-memory.dmp
memory/3900-3158-0x00000259989B0000-0x0000025998A6D000-memory.dmp
memory/3900-4055-0x00000259989B0000-0x0000025998A6D000-memory.dmp
memory/3900-2940-0x00000259989B0000-0x0000025998A6D000-memory.dmp
memory/3928-2630-0x00000000004E0000-0x000000000053E000-memory.dmp
memory/3960-3093-0x0000000000FD0000-0x0000000001047000-memory.dmp
memory/4140-3154-0x0000000000690000-0x0000000000707000-memory.dmp
memory/4632-2914-0x00000000004E0000-0x000000000053E000-memory.dmp
memory/4736-3155-0x0000000000690000-0x0000000000707000-memory.dmp
memory/4788-3046-0x0000000000910000-0x0000000000975000-memory.dmp
memory/4832-2807-0x0000000000FD0000-0x0000000001047000-memory.dmp
memory/5292-3047-0x0000000000910000-0x0000000000975000-memory.dmp
memory/5480-2676-0x00000000000F0000-0x0000000000155000-memory.dmp
memory/5552-2532-0x0000000000400000-0x0000000000404000-memory.dmp
memory/5636-2675-0x00000000000F0000-0x0000000000155000-memory.dmp
memory/5744-3088-0x0000000000FD0000-0x0000000001047000-memory.dmp
memory/5904-2808-0x0000000000FD0000-0x0000000001047000-memory.dmp
memory/6060-2917-0x0000000000690000-0x0000000000707000-memory.dmp