6685d7118367563913923c0963c4cc406c80c7b9ae50e98dddcf16bfaefae0cd

Analysis

max time kernel
299s
max time network
192s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gamehub-manager-2025-428-441-57.exe
Size 91.6MB
Sample260624-fd62baas2y
SHA256 6685d7118367563913923c0963c4cc406c80c7b9ae50e98dddcf16bfaefae0cd
MD5 26d97373c28f193d89532113630b265d
SHA1 a6338bb7f2eebc1bd67fd8189959f8dbac3f8359
SHA512 d2ddb6caca2932b1bafca552ebecd39359203b12d8ddc1da1e5f061f56c762c7f21bd08964e2c15c3294eaa6d679874059d4194037f1b4c22f125aec1270e9c8
SSDEEP 1572864:ypmoM7UPtpA8632XEGhbFTJ4CFiMX3MC/HPjYOEyy8B1R+IHfnRSrk0Z6p+Wp2/+:ypNGUPzi2XEYxfFiE3MqMOEyy84IHAOH
TLSH
T18C28332271AAFDE2D43651313F72D3D8B7BCFD086520C49AA9E0BC29563E15336B6391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
6040	VisualCppRedist_AIO_x86_x64.exe
5780	windowsdesktop-runtime-8.0.11-win-x64.exe
4020	windowsdesktop-runtime-8.0.11-win-x64.exe
2476	windowsdesktop-runtime-8.0.11-win-x64.exe
2564	windowsdesktop-runtime-8.0.11-win-x64.exe
1392	windowsdesktop-runtime-8.0.11-win-x64.exe
2780	windowsdesktop-runtime-8.0.11-win-x64.exe
5140	XiaoJi.GameHubManager.exe
4332	windowsdesktop-runtime-8.0.11-win-x64.exe

Loads dropped DLL 63 IoCs

pid	Process
5400	gamehub-manager-2025-428-441-57.exe
5400	gamehub-manager-2025-428-441-57.exe
5400	gamehub-manager-2025-428-441-57.exe
5400	gamehub-manager-2025-428-441-57.exe
5400	gamehub-manager-2025-428-441-57.exe
5564	vcredist_x86.exe
5732	vcredist_x64.exe
4788	vcredist_x86.exe
1416	vcredist_x64.exe
2384	VC_redist.x86.exe
2516	VC_redist.x64.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
1532	MsiExec.exe
4368	MsiExec.exe
6016	MsiExec.exe
4332	vcredist_x64.exe
1768	MsiExec.exe
2964	MsiExec.exe
3104	VC_redist.x86.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
1876	MsiExec.exe
5104	MsiExec.exe
4760	VC_redist.x64.exe
2492	MsiExec.exe
5712	MsiExec.exe
5928	MsiExec.exe
4372	MsiExec.exe
2640	MsiExec.exe
5204	MsiExec.exe
5596	MsiExec.exe
5596	MsiExec.exe
5204	MsiExec.exe
5204	MsiExec.exe
5400	gamehub-manager-2025-428-441-57.exe
4020	windowsdesktop-runtime-8.0.11-win-x64.exe
5600	MsiExec.exe
5600	MsiExec.exe
5896	MsiExec.exe
5896	MsiExec.exe
2780	windowsdesktop-runtime-8.0.11-win-x64.exe
5524	MsiExec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5544	icacls.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{bd40e761-3e88-4202-9b53-26c6bed3d467} = "\"C:\\ProgramData\\Package Cache\\{bd40e761-3e88-4202-9b53-26c6bed3d467}\\windowsdesktop-runtime-8.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{bd40e761-3e88-4202-9b53-26c6bed3d467} = "\"C:\\ProgramData\\Package Cache\\{bd40e761-3e88-4202-9b53-26c6bed3d467}\\windowsdesktop-runtime-8.0.11-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	VC_redist.x64.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msinet.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr70.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msadodc.ocx	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp110.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mscomctl.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comdlg32.ocx	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp71.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File created	C:\Windows\system32\msvcr120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70cht.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\richtx32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comctl32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msstkprp.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2720	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Memory.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\mscorrc.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Numerics.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.Http.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\Microsoft.DiaSymReader.Native.amd64.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.WebSockets.Client.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.Compression.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Private.CoreLib.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Collections.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Diagnostics.TraceSource.dll	msiexec.exe
File created	C:\Program Files\GameSir\GameHubManager\XiaoJi.GameHubManager.exe	gamehub-manager-2025-428-441-57.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\Microsoft.NETCore.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.FileSystem.AccessControl.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Runtime.Serialization.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Private.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\netstandard.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Data.dll	msiexec.exe
File created	C:\Program Files\GameSir\GameHubManager\appsettings.json	gamehub-manager-2025-428-441-57.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.ComponentModel.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.NameResolution.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\WindowsBase.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.IO.IsolatedStorage.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Console.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.11\System.Net.Http.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260624004859320.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB9F6068C967BE817.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{010792BA-551A-3AC0-A7EF-0FAB4156C382}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004921073.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004923290.0\mfc90cht.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3E62A8692F629212.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI238C.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260624004901563.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEB58175EB9A9E228.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI285D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8E563489B280A02D.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004859414.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004901563.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_f4ca2f60.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260624004923270.0	msiexec.exe
File created	C:\Windows\assembly\tmp\GL4I8YI6\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\SystemTemp\~DFF9A6E9AD639CCD15.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2871.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004859286.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004901575.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004921017.0\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_449d3952.manifest	msiexec.exe
File created	C:\Windows\SystemTemp\~DF72467F80FA52153B.TMP	msiexec.exe
File created	C:\Windows\assembly\tmp\W5SUI7S5\Microsoft.Office.Tools.Outlook.Implementation.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f205.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004901619.0\9.0.30729.7523.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004923288.0\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_3306cf11.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004923288.0\mfcm90.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D401961D-3A20-3AC7-943B-6139D5BD490A}	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Installer\SourceHash{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F267D2FE8B1F50A.TMP	msiexec.exe
File created	C:\Windows\assembly\tmp\YS6OYV7Y\Microsoft.Office.Tools.Word.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\70XP10OT84\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\SystemTemp\~DF15186FF8CEC3639B.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260624004923290.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_a38742d1.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vccorlib120_x86	msiexec.exe
File created	C:\Windows\assembly\tmp\LUZZN0SX\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DE.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\8520DAD7C5154DD39846DB1714990E7F\12.0.40660\F_CENTRAL_mfcm120u_x86	msiexec.exe
File created	C:\Windows\SystemTemp\~DF42F058E3AFE5AF37.TMP	msiexec.exe
File created	C:\Windows\Installer\e59f2cf.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\e59f2d0.msi	msiexec.exe
File created	C:\Windows\Installer\e59f209.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7041.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI1070.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2087.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2800	2516	WerFault.exe	279
5824	4020	WerFault.exe	793
6128	2780	WerFault.exe	799

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualCppRedist_AIO_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.11-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ed6836836fe2a8780000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ed6836830000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ed683683000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ed68368300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ed68368300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{232E456A-87C3-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{F1651457-356D-4CA2-989D-701606A4C828}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{79C784C5-8F0D-4A55-ADB3-590CCFC8EB0D}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9012A7B8-F56E-11D0-8043-00C04FB6C701}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\AlternateCLSID = "{2B577565-36F7-4351-B2E7-DAFC75E9D72A}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{21D93911-CB0F-11D0-84AC-00A0C90DC8A9}\AlternateCLSID = "{20E72BC7-287F-4FCD-BFB7-156FF242C27C}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\AlternateCLSID = "{627C8B79-918A-4c5c-9E19-20F66BF30B86}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0ECD9B64-23AA-11D0-B351-00A0C9055D8E}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{612685EF-57C8-469F-88AB-E4E0B595C5AB}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{97992019-74A6-46C7-9CA3-7F8C0D39940B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAB97084-FC6C-11D0-805D-00C04FB6C701}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6DB041E-66D0-48BC-8797-57C24F5C801C}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{43478D73-78E0-11CF-8E78-00A0D100038E}\AlternateCLSID = "{6785E9BB-087E-4772-8CA5-3331CC3B574E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{67397AA3-7FB1-11D0-B148-00A0C922E820}\AlternateCLSID = "{234086BB-0242-46C5-B71F-5A9B961DB911}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{97992019-74A6-46C7-9CA3-7F8C0D39940B}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\AlternateCLSID = "{E2D211D5-11E4-4D9E-B6DB-1E902C851A49}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CDE57A43-8B86-11D0-B3C6-00A0C90AEA82}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CDE57A43-8B86-11D0-B3C6-00A0C90AEA82}\AlternateCLSID = "{225957BB-0005-48B9-8BFB-11AEE66779FB}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{3D8152C1-0CFD-4968-9684-794046886E31}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}\AlternateCLSID = "{D7FFEFBC-C693-4E6F-AE2E-ED001389CB17}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}\AlternateCLSID = "{894BA3A3-3CA3-402F-B4FE-CD08337E9535}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6B7E638F-850A-101B-AFC0-4210102A8DA7}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{67397AA3-7FB1-11D0-B148-00A0C922E820}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CA0-15DA-101B-B9A8-444553540000}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED}\AlternateCLSID = "{7E96FC67-468E-4E70-B246-D42078DD2361}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00028C00-0000-0000-0000-000000000046}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C932BA85-4374-101B-A56C-00AA003668DC}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{A0E7BF67-8D30-4620-8825-7111714C7CAB}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\CLSID = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{59245250-7A2F-11D0-9482-00A0C91110ED}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8C344712-5FEC-11CF-A0BF-00AA0062BE57}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\AlternateCLSID = "{942085FD-8AEE-465F-ADD7-5E7AA28F8C14}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{601EB760-8909-11D0-9483-00A0C91110ED}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\43	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\45	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\47	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\45	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\46	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\46	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Control	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_64.44.23191_x64\Dependents\{bd40e761-3e88-4202-9b53-26c6bed3d467}	windowsdesktop-runtime-8.0.11-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074F0-BA0A-11D1-B137-0000F8753F5D}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E71F050-551F-11CF-8152-00AA00A40C25}\ = "rdoPreparedStatement"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}\MiscStatus	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E71F052-551F-11CF-8152-00AA00A40C25}\TypeLib\Version = "2.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSSTDFMT.StdDataValue\CLSID\ = "{2B11E9B0-9F09-11D0-9484-00A0C91110ED}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3D8152C1-0CFD-4968-9684-794046886E31}\VersionIndependentProgID\ = "MSComCtl2.Animation"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CEDFFAFD-3C2F-4552-9FD3-3DC4299057FD}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{43478D73-78E0-11CF-8E78-00A0D100038E}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{979127D3-7D01-4FDE-AF65-A698091468AF}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DHTMLPageDesigner.DHTMLPageRuntimeWinEvent\CurVer\ = "DHTMLPageDesigner.DHTMLPageRuntimeWinEvent.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Toolbar	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{030B4A82-1B7C-11CF-9D53-00AA003C9CB6}\ = "UpDown Buddy Propery Page Object"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CDE57A43-8B86-11D0-B3C6-00A0C90AEA82}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9E074CF-BA0A-11D1-B137-0000F8753F5D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CDE57A44-8B86-11D0-B3C6-00A0C90AEA82}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Control	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E07511-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8B39DFBC-3647-11CF-814A-00AA00A40C25}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{703EAF2B-FD9F-41BC-BB81-6C6757A46E5E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20C62CAD-15DA-101B-B9A8-444553540000}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D8C1B55B-12DC-457F-97EC-4B84305FAA13}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{37AD4A20-8F65-11D0-9484-00A0C91110ED}\1.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B314611-2C19-4AB4-8513-A6EEA569D3C4}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AB36A920-23A5-11D0-B351-00A0C9055D8E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl\ = "Microsoft ImageList Control, version 5.0 (SP2)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{86CF1D34-0C5F-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{CDE57A4F-8B86-11D0-B3C6-00A0C90AEA82}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25A3C2C9-8F6E-4140-BEF3-535D4B9709D8}\ToolboxBitmap32\ = "C:\\Windows\\SysWOW64\\comctl32.ocx, 3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9E074D1-BA0A-11D1-B137-0000F8753F5D}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDE57A53-8B86-11D0-B3C6-00A0C90AEA82}\TypeLib\ = "{CDE57A40-8B86-11D0-B3C6-00A0C90AEA82}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{648A5604-2C6E-101B-82B6-000000000014}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E0752A-BA0A-11D1-B137-0000F8753F5D}\ = "IVcDataPoints"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSComCtl2.FlatScrollBar\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAB9C2AA-6036-4AE1-A41C-A40AB7F39520}\a.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{942085FD-8AEE-465F-ADD7-5E7AA28F8C14}\Version\ = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1FB5F95B8C762083E895C25E153AF95C	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\MiscStatus\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\5.0\HELPDIR\ = "C:\\Windows\\SysWOW64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{43478D73-78E0-11CF-8E78-00A0D100038E}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{942085FD-8AEE-465F-ADD7-5E7AA28F8C14}\Required Categories\{D40C2700-FFA1-11CF-8234-00AA00C1AB85}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04A-858B-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38911D9C-E448-11D0-84A3-00DD01104159}\ = "BandProperties"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_64.44.23191_x64\Dependents	windowsdesktop-runtime-8.0.11-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\ProgId\ = "bootstrap.vsto.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{951738D1-D2B7-11D0-B292-00A0C908FB55}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{699DDBCC-DC7E-11D0-BCF7-00C04FC2FB86}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5492	reg.exe
5072	reg.exe
1200	reg.exe
2368	reg.exe
3392	reg.exe
2816	reg.exe
120	reg.exe
1268	reg.exe
5712	reg.exe
6016	reg.exe
1412	reg.exe
5372	reg.exe
1220	reg.exe
2488	reg.exe
2260	reg.exe
4236	reg.exe
4440	reg.exe
5448	reg.exe
1424	reg.exe
2800	reg.exe
5408	reg.exe
4660	reg.exe
5888	reg.exe
6132	reg.exe
2984	reg.exe
3500	reg.exe
2480	reg.exe
5376	reg.exe
1964	reg.exe
5924	reg.exe
3844	reg.exe
620	reg.exe
3216	reg.exe
3928	reg.exe
2528	reg.exe
3024	reg.exe
5900	reg.exe
108	reg.exe
484	reg.exe
1744	reg.exe
2500	reg.exe
4448	reg.exe
3288	reg.exe
3356	reg.exe
1888	reg.exe
1128	reg.exe
5064	reg.exe
2908	reg.exe
1744	reg.exe
3124	reg.exe
5544	reg.exe
1412	reg.exe
2256	reg.exe
480	reg.exe
3520	reg.exe
900	reg.exe
4056	reg.exe
5660	reg.exe
2688	reg.exe
1512	reg.exe
1556	reg.exe
3236	reg.exe
2340	reg.exe
1908	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4084	WMIC.exe
4084	WMIC.exe
4084	WMIC.exe
4084	WMIC.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe
3596	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeSecurityPrivilege	4084	WMIC.exe
Token: SeTakeOwnershipPrivilege	4084	WMIC.exe
Token: SeLoadDriverPrivilege	4084	WMIC.exe
Token: SeSystemProfilePrivilege	4084	WMIC.exe
Token: SeSystemtimePrivilege	4084	WMIC.exe
Token: SeProfSingleProcessPrivilege	4084	WMIC.exe
Token: SeIncBasePriorityPrivilege	4084	WMIC.exe
Token: SeCreatePagefilePrivilege	4084	WMIC.exe
Token: SeBackupPrivilege	4084	WMIC.exe
Token: SeRestorePrivilege	4084	WMIC.exe
Token: SeShutdownPrivilege	4084	WMIC.exe
Token: SeDebugPrivilege	4084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4084	WMIC.exe
Token: SeRemoteShutdownPrivilege	4084	WMIC.exe
Token: SeUndockPrivilege	4084	WMIC.exe
Token: SeManageVolumePrivilege	4084	WMIC.exe
Token: 33	4084	WMIC.exe
Token: 34	4084	WMIC.exe
Token: 35	4084	WMIC.exe
Token: 36	4084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeSecurityPrivilege	4084	WMIC.exe
Token: SeTakeOwnershipPrivilege	4084	WMIC.exe
Token: SeLoadDriverPrivilege	4084	WMIC.exe
Token: SeSystemProfilePrivilege	4084	WMIC.exe
Token: SeSystemtimePrivilege	4084	WMIC.exe
Token: SeProfSingleProcessPrivilege	4084	WMIC.exe
Token: SeIncBasePriorityPrivilege	4084	WMIC.exe
Token: SeCreatePagefilePrivilege	4084	WMIC.exe
Token: SeBackupPrivilege	4084	WMIC.exe
Token: SeRestorePrivilege	4084	WMIC.exe
Token: SeShutdownPrivilege	4084	WMIC.exe
Token: SeDebugPrivilege	4084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4084	WMIC.exe
Token: SeRemoteShutdownPrivilege	4084	WMIC.exe
Token: SeUndockPrivilege	4084	WMIC.exe
Token: SeManageVolumePrivilege	4084	WMIC.exe
Token: 33	4084	WMIC.exe
Token: 34	4084	WMIC.exe
Token: 35	4084	WMIC.exe
Token: 36	4084	WMIC.exe
Token: SeBackupPrivilege	1068	vssvc.exe
Token: SeRestorePrivilege	1068	vssvc.exe
Token: SeAuditPrivilege	1068	vssvc.exe
Token: SeBackupPrivilege	3208	srtasks.exe
Token: SeRestorePrivilege	3208	srtasks.exe
Token: SeSecurityPrivilege	3208	srtasks.exe
Token: SeTakeOwnershipPrivilege	3208	srtasks.exe
Token: SeShutdownPrivilege	1556	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	1556	vcredist_x64.exe
Token: SeSecurityPrivilege	3596	msiexec.exe
Token: SeCreateTokenPrivilege	1556	vcredist_x64.exe
Token: SeAssignPrimaryTokenPrivilege	1556	vcredist_x64.exe
Token: SeLockMemoryPrivilege	1556	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	1556	vcredist_x64.exe
Token: SeMachineAccountPrivilege	1556	vcredist_x64.exe
Token: SeTcbPrivilege	1556	vcredist_x64.exe
Token: SeSecurityPrivilege	1556	vcredist_x64.exe
Token: SeTakeOwnershipPrivilege	1556	vcredist_x64.exe
Token: SeLoadDriverPrivilege	1556	vcredist_x64.exe
Token: SeSystemProfilePrivilege	1556	vcredist_x64.exe
Token: SeSystemtimePrivilege	1556	vcredist_x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6040	VisualCppRedist_AIO_x86_x64.exe

Suspicious use of SetWindowsHookEx 51 IoCs

pid	Process
3596	msiexec.exe
1180	msiexec.exe
1532	MsiExec.exe
3736	msiexec.exe
4368	MsiExec.exe
2928	msiexec.exe
6016	MsiExec.exe
248	msiexec.exe
1768	MsiExec.exe
5888	msiexec.exe
2964	MsiExec.exe
4812	msiexec.exe
1876	MsiExec.exe
4632	msiexec.exe
5104	MsiExec.exe
5952	msiexec.exe
2492	MsiExec.exe
2872	msiexec.exe
3888	msiexec.exe
2312	msiexec.exe
5712	MsiExec.exe
924	msiexec.exe
1072	msiexec.exe
5892	msiexec.exe
824	msiexec.exe
3464	msiexec.exe
1568	msiexec.exe
5600	msiexec.exe
5880	msiexec.exe
5296	msiexec.exe
5928	MsiExec.exe
3276	msiexec.exe
592	msiexec.exe
2100	msiexec.exe
6032	msiexec.exe
2688	msiexec.exe
4448	msiexec.exe
5784	msiexec.exe
2880	msiexec.exe
4632	msiexec.exe
4372	MsiExec.exe
2640	MsiExec.exe
2776	MsiExec.exe
5204	MsiExec.exe
5596	MsiExec.exe
824	msiexec.exe
4876	msiexec.exe
1328	msiexec.exe
5600	MsiExec.exe
5896	MsiExec.exe
5524	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 2720	5400	gamehub-manager-2025-428-441-57.exe	87
PID 5400 wrote to memory of 5544	5400	gamehub-manager-2025-428-441-57.exe	90
PID 5400 wrote to memory of 6040	5400	gamehub-manager-2025-428-441-57.exe	93
PID 6040 wrote to memory of 4188	6040	VisualCppRedist_AIO_x86_x64.exe	94
PID 4188 wrote to memory of 3476	4188	cmd.exe	96
PID 3476 wrote to memory of 4452	3476	cmd.exe	97
PID 4188 wrote to memory of 2492	4188	cmd.exe	98
PID 4188 wrote to memory of 1580	4188	cmd.exe	99
PID 4188 wrote to memory of 5828	4188	cmd.exe	100
PID 4188 wrote to memory of 5384	4188	cmd.exe	101
PID 4188 wrote to memory of 4084	4188	cmd.exe	102
PID 4188 wrote to memory of 5376	4188	cmd.exe	103
PID 4188 wrote to memory of 1536	4188	cmd.exe	104
PID 1536 wrote to memory of 4488	1536	cmd.exe	105
PID 4188 wrote to memory of 4552	4188	cmd.exe	106
PID 4552 wrote to memory of 1972	4552	cmd.exe	107
PID 4188 wrote to memory of 604	4188	cmd.exe	108
PID 604 wrote to memory of 2972	604	cmd.exe	109
PID 4188 wrote to memory of 992	4188	cmd.exe	110
PID 4188 wrote to memory of 6060	4188	cmd.exe	111
PID 4188 wrote to memory of 4460	4188	cmd.exe	112
PID 4188 wrote to memory of 1040	4188	cmd.exe	113
PID 4188 wrote to memory of 4528	4188	cmd.exe	114
PID 4528 wrote to memory of 1664	4528	cmd.exe	115
PID 4188 wrote to memory of 3272	4188	cmd.exe	116
PID 4188 wrote to memory of 3604	4188	cmd.exe	117
PID 3604 wrote to memory of 6036	3604	cmd.exe	118
PID 4188 wrote to memory of 5524	4188	cmd.exe	119
PID 4188 wrote to memory of 5584	4188	cmd.exe	120
PID 5584 wrote to memory of 5636	5584	cmd.exe	121
PID 4188 wrote to memory of 5960	4188	cmd.exe	122
PID 4188 wrote to memory of 1608	4188	cmd.exe	123
PID 1608 wrote to memory of 5792	1608	cmd.exe	124
PID 4188 wrote to memory of 4616	4188	cmd.exe	125
PID 4188 wrote to memory of 5680	4188	cmd.exe	126
PID 4188 wrote to memory of 1564	4188	cmd.exe	127
PID 4188 wrote to memory of 4504	4188	cmd.exe	128
PID 4188 wrote to memory of 4492	4188	cmd.exe	129
PID 4188 wrote to memory of 4784	4188	cmd.exe	130
PID 4188 wrote to memory of 2136	4188	cmd.exe	131
PID 4188 wrote to memory of 5328	4188	cmd.exe	132
PID 4188 wrote to memory of 5596	4188	cmd.exe	133
PID 4188 wrote to memory of 5780	4188	cmd.exe	134
PID 4188 wrote to memory of 2908	4188	cmd.exe	135
PID 4188 wrote to memory of 5448	4188	cmd.exe	136
PID 4188 wrote to memory of 4820	4188	cmd.exe	137
PID 4188 wrote to memory of 1336	4188	cmd.exe	138
PID 4188 wrote to memory of 2256	4188	cmd.exe	139
PID 4188 wrote to memory of 6008	4188	cmd.exe	140
PID 4188 wrote to memory of 3928	4188	cmd.exe	141
PID 4188 wrote to memory of 480	4188	cmd.exe	142
PID 4188 wrote to memory of 1980	4188	cmd.exe	143
PID 4188 wrote to memory of 1512	4188	cmd.exe	144
PID 4188 wrote to memory of 4836	4188	cmd.exe	145
PID 4188 wrote to memory of 2272	4188	cmd.exe	146
PID 4188 wrote to memory of 5976	4188	cmd.exe	147
PID 4188 wrote to memory of 548	4188	cmd.exe	148
PID 4188 wrote to memory of 4576	4188	cmd.exe	149
PID 4188 wrote to memory of 4660	4188	cmd.exe	150
PID 4188 wrote to memory of 2736	4188	cmd.exe	151
PID 4188 wrote to memory of 828	4188	cmd.exe	152
PID 4188 wrote to memory of 824	4188	cmd.exe	153
PID 4188 wrote to memory of 4372	4188	cmd.exe	154
PID 4188 wrote to memory of 5272	4188	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\gamehub-manager-2025-428-441-57.exe
"C:\Users\Admin\AppData\Local\Temp\gamehub-manager-2025-428-441-57.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq XiaoJi.GameHubManager.exe" /FO list
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Program Files\GameSir\GameHubManager" /reset
  2⤵
  - Modifies file permissions
  PID:5544
- C:\Program Files\GameSir\GameHubManager\Addons\_Redist\VisualCppRedist_AIO_x86_x64.exe
  "C:\Program Files\GameSir\GameHubManager\Addons\_Redist\VisualCppRedist_AIO_x86_x64.exe" /aiA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /quiet"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Windows\system32\reg.exe
        
        reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:4452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2492
  - - C:\Windows\system32\findstr.exe
      findstr /c:" 5."
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      System Location Discovery: System Language Discovery
      PID:5828
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKU\S-1-5-19"
      4⤵
      PID:5384
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4084
  - - C:\Windows\system32\find.exe
      find /i "ComputerSystem"
      4⤵
      PID:5376
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
        5⤵
        
        PID:4488
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
        5⤵
        
        PID:1972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      Suspicious use of WriteProcessMemory
      PID:604
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
        5⤵
        
        PID:2972
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:992
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:6060
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:4460
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:1040
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
        5⤵
        
        PID:1664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40219.473
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3604
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
        5⤵
        
        PID:6036
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.61135.400
      4⤵
      PID:5524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5584
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
        5⤵
        
        PID:5636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40664.0
      4⤵
      PID:5960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
        5⤵
        
        PID:5792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 42.34226.3
      4⤵
      System Location Discovery: System Language Discovery
      PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5680
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      PID:4504
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      PID:4784
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      PID:5328
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:5596
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
      4⤵
      PID:5780
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      Modifies registry key
      PID:2908
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
      4⤵
      Modifies registry key
      PID:5448
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:4820
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
      4⤵
      PID:1336
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
      4⤵
      Modifies registry key
      PID:2256
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:6008
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      Modifies registry key
      PID:3928
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      Modifies registry key
      PID:480
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
      4⤵
      PID:1980
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
      4⤵
      Modifies registry key
      PID:1512
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4F66CF07-B4DB-46F6-84E9-3640CDE36006} /v UninstallString
      4⤵
      PID:4836
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A640D564-FA8E-481B-ABC6-B2B572FDD83B} /v UninstallString
      4⤵
      PID:2272
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      PID:5976
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:548
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4576
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4660
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2736
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:828
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 Redistributable" /s
      4⤵
      PID:824
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4372
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5272
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
      4⤵
      PID:5844
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3136
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1560
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3844
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3808
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5920
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
      4⤵
      PID:1096
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5624
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5612
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
      4⤵
      PID:2596
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5944
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3836
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
      4⤵
      PID:1720
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:6032
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3004
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:1744
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5664
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5744
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
      4⤵
      PID:5504
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5452
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1308
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:1424
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2760
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3380
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2528
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2684
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:752
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
      4⤵
      PID:2576
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1876
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3528
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
      4⤵
      PID:5468
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3096
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3056
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:5924
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4520
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:120
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
      4⤵
      PID:244
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5372
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4776
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
      4⤵
      PID:5600
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4896
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:348
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
      4⤵
      PID:264
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:240
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:460
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
      4⤵
      Modifies registry key
      PID:1556
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1056
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5648
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
      4⤵
      PID:2312
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2428
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2708
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
      4⤵
      Modifies registry key
      PID:1200
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3304
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:624
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
      4⤵
      PID:4736
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4052
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2232
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
      4⤵
      PID:1844
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2004
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4972
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
      4⤵
      PID:4228
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2172
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4244
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:3520
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5888
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1288
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
      4⤵
      PID:1540
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4808
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3124
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
      4⤵
      PID:3276
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5684
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:6124
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
      4⤵
      PID:4572
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3548
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4712
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2500
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1944
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3436
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
      4⤵
      PID:6016
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3192
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1568
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5072
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2016
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3044
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
      4⤵
      PID:5672
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1712
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5140
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
      4⤵
      PID:3156
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /quiet /norestart
      4⤵
      PID:3064
    - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /quiet /norestart -burn.unelevated BurnPipe.{685986CF-1884-40B2-8E93-A3FB986F7D73} {F8948CAA-EAE3-4B42-9635-B92587871822} 3064
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5564
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
      4⤵
      PID:3104
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /quiet /norestart
      4⤵
      PID:3116
    - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /quiet /norestart -burn.unelevated BurnPipe.{0AA35A99-7FCA-4C95-B89C-8408A386D1E7} {F8D7CB5D-E0A7-4EA4-BB9D-99DA7F882C60} 3116
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:5732
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
      4⤵
      PID:3368
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /quiet /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:6100
    - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /quiet /norestart -burn.unelevated BurnPipe.{AFA6073D-9E32-499F-8260-FA064E74E78E} {899C3876-520A-4425-8A51-B34FD32F49D5} 6100
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4788
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
      4⤵
      PID:4924
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /quiet /norestart
      4⤵
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:1556
    - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /quiet /norestart -burn.unelevated BurnPipe.{5A7127FB-AF62-4DD0-9113-BC83807D3AA6} {39959E22-094B-4158-BC92-4BD1E287CB0C} 1556
        5⤵
        Loads dropped DLL
        
        PID:1416
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
      4⤵
      Modifies registry key
      PID:2368
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /quiet /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 /uninstall /quiet /norestart
        5⤵
        Loads dropped DLL
        
        PID:2384
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9479CBFB-E93A-47A8-9C32-64F247605C38} {E9337295-CBE7-4B19-8745-87EF81FB59C8} 2384
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1800
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
      4⤵
      PID:3348
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /quiet /norestart
      4⤵
      PID:3528
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592 /uninstall /quiet /norestart
        5⤵
        Loads dropped DLL
        
        PID:2516
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A588BA64-D378-44F4-8745-8D1EBF3FB021} {2399A3A9-DE89-45C2-A3FA-FE1A1577EAE3} 2516
        6⤵
        Adds Run key to start application
        
        PID:4896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 956
        6⤵
        Program crash
        
        PID:2800
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
      4⤵
      PID:3676
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
      4⤵
      PID:2676
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      PID:5648
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /quiet /norestart
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1180
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
      4⤵
      PID:1960
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      PID:1252
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:3736
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
      4⤵
      PID:4888
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      PID:4876
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2928
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
      4⤵
      PID:5936
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
      4⤵
      PID:4348
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{7DAD0258-515C-3DD4-8964-BD714199E0F7} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:248
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /f
      4⤵
      PID:4524
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
      4⤵
      Modifies registry key
      PID:3124
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:5888
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /f
      4⤵
      PID:5840
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
      4⤵
      PID:5520
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
        5⤵
        
        PID:2708
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.60917.0
      4⤵
      PID:4812
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
      4⤵
      PID:592
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
      4⤵
      Modifies registry key
      PID:3392
  - - C:\Windows\system32\find.exe
      find /i "TRIN_TRIR_SETUP"
      4⤵
      PID:3436
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime Redistributable" /s
      4⤵
      Modifies registry key
      PID:2800
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:716
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6068
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
        5⤵
        
        PID:4052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40219.473
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2896
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
        5⤵
        
        PID:576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.61135.400
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp140.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1416
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp140.dll"
        5⤵
        
        PID:460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 42.34226.3
      4⤵
      System Location Discovery: System Language Discovery
      PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      PID:3024
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      PID:1548
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:5384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2116
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1112
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:544
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
      4⤵
      PID:3824
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
      4⤵
      PID:5956
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
      4⤵
      Modifies registry key
      PID:5408
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:5688
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
      4⤵
      Modifies registry key
      PID:1412
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
      4⤵
      PID:3560
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:5000
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
      4⤵
      PID:2416
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
      4⤵
      Modifies registry key
      PID:5544
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
      4⤵
      Modifies registry key
      PID:3236
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
      4⤵
      PID:1632
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{332674FD-CCDD-43E5-8702-8BDF9DC53F21} /v UninstallString
      4⤵
      Modifies registry key
      PID:620
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B7EEB151-1025-42E0-AB63-539C3832396B} /v UninstallString
      4⤵
      PID:1620
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      PID:6132
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5084
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4936
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
      4⤵
      PID:5856
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3420
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5096
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 Redistributable" /s
      4⤵
      PID:2028
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3504
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1888
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
      4⤵
      PID:2768
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1252
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:560
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4448
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2688
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4932
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
      4⤵
      PID:3500
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2796
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3404
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
      4⤵
      PID:5792
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3444
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2852
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
      4⤵
      PID:712
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2528
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2656
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:1268
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5508
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5288
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
      4⤵
      PID:2556
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5572
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3888
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
      4⤵
      PID:2532
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3280
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4332
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2340
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3836
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3916
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
      4⤵
      PID:2428
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5556
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2312
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:5372
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:124
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:248
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:5712
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2268
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3548
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
      4⤵
      PID:3400
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:6124
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5876
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:5888
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4916
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5516
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
      4⤵
      PID:3416
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
      4⤵
      PID:2708
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /quiet /norestart
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4812
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
      4⤵
      Modifies registry key
      PID:1412
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
      4⤵
      PID:4616
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{37B8F9C7-03FB-3253-8781-2517C99D7C00} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:4632
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /f
      4⤵
      PID:5496
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
      4⤵
      Modifies registry key
      PID:6132
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:5952
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /f
      4⤵
      PID:5792
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} /v UninstallString
      4⤵
      Modifies registry key
      PID:6016
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2872
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41} /f
      4⤵
      PID:4348
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5} /v UninstallString
      4⤵
      Modifies registry key
      PID:1908
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{662A0088-6FCD-45DD-9EA7-68674058AED5} /quiet /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:3888
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{662A0088-6FCD-45DD-9EA7-68674058AED5} /f
      4⤵
      PID:3356
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2312
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:924
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qn /norestart
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1072
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5892
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:824
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:3464
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:1568
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:5600
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:5880
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:5296
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:3276
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qn /norestart
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:592
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2100
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:6032
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2688
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qn /norestart
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4448
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeMinimum_x86.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:5784
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeAdditional_x86.msi" /qn /norestart
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2880
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qn /norestart
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4632
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      Modifies registry key
      PID:2816
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      Modifies registry key
      PID:1220
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
      4⤵
      PID:2028
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /quiet /norestart
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:824
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /quiet /norestart
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4876
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qn /norestart
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ARP.cmd" /auto"
    3⤵
    PID:3808
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
      4⤵
      PID:6140
  - - C:\Windows\system32\findstr.exe
      FINDSTR 2600
      4⤵
      PID:5668
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKU\S-1-5-19"
      4⤵
      PID:1564
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      PID:2352
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4920
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3280
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
      4⤵
      PID:1908
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1540
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5396
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
      4⤵
      PID:3356
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1768
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2564
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
      4⤵
      PID:4276
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:484
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3888
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
      4⤵
      PID:524
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1028
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2288
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2488
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2444
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5340
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
      4⤵
      PID:6104
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2704
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2544
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
      4⤵
      PID:988
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5516
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5548
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
      4⤵
      PID:404
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5764
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2800
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:900
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3416
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4060
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4056
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5812
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3148
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2984
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2308
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4728
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
      4⤵
      PID:2604
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3388
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4668
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:3500
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5324
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4136
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
      4⤵
      PID:2072
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2292
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2312
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2260
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5676
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5652
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
      4⤵
      PID:5884
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2988
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1424
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime" /s
      4⤵
      Modifies registry key
      PID:5660
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5384
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5956
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Basic/C++ Runtime" /s
      4⤵
      PID:1380
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2252
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4660
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Basic Runtime" /s
      4⤵
      PID:2108
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3564
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4504
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2002-2003 Runtime" /s
      4⤵
      PID:2132
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5988
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2152
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      Modifies registry key
      PID:3024
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4452
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2832
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
      4⤵
      PID:4988
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1096
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:6076
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s
      4⤵
      PID:5272
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5720
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1580
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
      4⤵
      PID:5784
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1396
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2880
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:120
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1972
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5084
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
      4⤵
      PID:552
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5880
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:6132
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:4236
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3620
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1876
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
      4⤵
      PID:5096
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2000
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2768
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:2480
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1252
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2740
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:5376
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5592
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1532
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
      4⤵
      PID:2860
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5780
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5732
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:5900
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2360
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5288
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:108
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5572
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4348
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
      4⤵
      PID:5952
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2556
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4332
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
      4⤵
      PID:1568
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2908
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1732
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
      4⤵
      PID:3300
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5392
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:828
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
      4⤵
      PID:4932
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1192
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1260
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime" /s
      4⤵
      Modifies registry key
      PID:3288
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1328
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1248
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Basic/C++ Runtime" /s
      4⤵
      PID:5240
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:6128
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5312
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Basic Runtime" /s
      4⤵
      Modifies registry key
      PID:2688
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2052
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2408
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2002-2003 Runtime" /s
      4⤵
      PID:5576
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4788
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3280
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi32.txt"
      4⤵
      PID:1540
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      PID:5396
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3216
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      PID:3248
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:3356
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:1888
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A640D564-FA8E-481B-ABC6-B2B572FDD83B} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:4440
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4F66CF07-B4DB-46F6-84E9-3640CDE36006} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      PID:2780
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:484
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi96.txt"
      4⤵
      PID:3256
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:1128
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:1964
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:5064
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:1744
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      PID:5916
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B7EEB151-1025-42E0-AB63-539C3832396B} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      PID:1352
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{332674FD-CCDD-43E5-8702-8BDF9DC53F21} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      Modifies registry key
      PID:5492
  - - C:\Windows\system32\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /f /v SystemComponent /t REG_DWORD /d 1
      4⤵
      PID:4032
- C:\Program Files\GameSir\GameHubManager\Addons\_Redist\windowsdesktop-runtime-8.0.11-win-x64.exe
  "C:\Program Files\GameSir\GameHubManager\Addons\_Redist\windowsdesktop-runtime-8.0.11-win-x64.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  PID:5780
- - C:\Windows\Temp\{02494E7A-093D-4D19-BD19-679FAE28960D}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe
    "C:\Windows\Temp\{02494E7A-093D-4D19-BD19-679FAE28960D}\.cr\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.clean.room="C:\Program Files\GameSir\GameHubManager\Addons\_Redist\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.filehandle.attached=760 -burn.filehandle.self=596 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4020
  - - C:\Windows\Temp\{75FA9C28-A79D-4EF5-B8AC-4D4A70D0C857}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
      "C:\Windows\Temp\{75FA9C28-A79D-4EF5-B8AC-4D4A70D0C857}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{9702D8BB-02B8-4CDD-8DAF-0A47202B44C4} {1924F4F6-17CA-4E4C-AFC9-6F1AE8603F30} 4020
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:2476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 988
      4⤵
      Program crash
      PID:5824
- C:\Program Files\GameSir\GameHubManager\XiaoJi.GameHubManager.exe
  "C:\Program Files\GameSir\GameHubManager\XiaoJi.GameHubManager.exe" --first
  2⤵
  - Executes dropped EXE
  PID:5140

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3208

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3596
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 908124213B5F85DCBB99AE0F6EC14000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A1A01E0902B823993B0B2AD396324C2A
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 47B5BC8B29B70641450D21DD4830257B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 251D1F89EB67674BF356D6F4DADA5BE4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 95E6346FBB150E1B080870EDA5798DEA
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2964
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding EF4052697259726E5F57E839AC139071
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7EA4B1AD7021B3E7F7FDC8489C7A0136
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5104
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 88FA74985DB31D57999FEA465B5A7605
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 617BACA19938C7A5950FE3867758C63F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5712
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 61A5ABBC562813879EFD4267E81FFC48
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F4CA82501162C75F842C071087AF455A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4372
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 59C0DB61C3695F3964B45E4072BF8A8C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2640
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 78DCCAC6371111AF3BA5529D15CFFC4A M Global\MSI0000
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2776
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F8C3AD9FD2BD8B6246EAAB81FC1E00FC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5204
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    PID:3148
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:5540
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 074129FC25B2C1EBABD13C9C3D060B12 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5596
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3548
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5580
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:752
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:368
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3872
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4100
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:616
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3280
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2564
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4276
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:5064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3148
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:5516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4120
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1236
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4764
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4640
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1424
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1224
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1396
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5832
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3560
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1808
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4484
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1924
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1420
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5572
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2556
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4100
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5284
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4716
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1492
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5672
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5372
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1408
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2464
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1684
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2628
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1980
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1328
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:5728
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5404
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3348
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1568
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:6128
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1716
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:5332
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:624
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:1952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1FB94AFEA8130A1F9502CBE9EBC3916
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5600
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E5EF816529E96ACD7F8AA3E5B75C1E19
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5896
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C3AA2E8996768434CB329D799F767D6A
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:5524

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2616
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /quiet /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004832.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4808
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /quiet /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004832.log" -burn.unelevated BurnPipe.{B7D9734C-CCBA-447A-A633-DC191A7BD8DB} {4094E1B0-710E-4A73-B80D-9E9ADD918653} 4808
    3⤵
    - Loads dropped DLL
    PID:4332

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2588
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /quiet /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260624004835.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4084
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592 /quiet /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260624004835.log"
    3⤵
    - Loads dropped DLL
    PID:3104

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:1200
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /quiet /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004837.log"
  2⤵
  PID:4260
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /quiet /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004837.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4760
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{319EAA45-CA93-4F67-A372-E308D1DE05A7} {F2A412A2-1D5E-4CC9-AA6B-11B7FFF71B39} 4760
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2516 -ip 2516
1⤵
PID:3564

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5576

C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe
"C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564
- C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe
  "C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20260624005012.log" /install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1392
- - C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe
    "C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=592 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.11_(x64)_20260624005012.log" /install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2780
  - - C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe
      "C:\ProgramData\Package Cache\{bd40e761-3e88-4202-9b53-26c6bed3d467}\windowsdesktop-runtime-8.0.11-win-x64.exe" -q -burn.elevated BurnPipe.{A123D990-2770-439A-AF6C-F0F6D05DB103} {39E9A38E-CD49-418C-AFD0-F9E7CE29199F} 2780
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      PID:4332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 1064
      4⤵
      Program crash
      PID:6128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4020 -ip 4020
1⤵
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2780 -ip 2780
1⤵
PID:5776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f19c.rbs

Path C:\Config.Msi\e59f19c.rbs
Size 22KB
SHA256 436854d467af689457cf446af2de5375d5f4fa14cbf23e535238eb3b0ddde189
MD5 2ecec5ce58426fb28158ca6380b535d4
SHA1 8e3b871cd61bc4d08d62aa9aeccb61bbeb42368c
SHA512 672fc0f5ee29942d6e4789edef18e2265e8820bb2da78b894fa5396058b645290b25c60563e188dfe72b3436d9bdd9949e4deef567961d1b9f2ac919f1256865
SSDEEP 384:9HRVRR2NUZUGz5YkrcZqbogvXD8f4/aQ/VUrNMFOK7:9xVtiM5
TLSH
T17EA2CC026640D5E3C86B2B30ED671B693B32D7D59364878740DD90748EA73C72F6EA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f1ad.rbs

Path C:\Config.Msi\e59f1ad.rbs
Size 15KB
SHA256 c7a83f1f88a32f92a1ebb5fe1a056a08b1aa17feae71d204dbb92b11fe1d8c0d
MD5 585b1506e7e4d6e55513c257374de21e
SHA1 2f20629a65c80d5b20633d54c4cc52556801fc17
SHA512 494e692272e5ec36cca01ef414d4d0042d9f2094bb118cb88b1431e94f6bdcc4a0ea7f8a00af14332ad73aa4fda0b205364eca354689a85b3d65a2a1838ffdcf
SSDEEP 384:9FkR/LX27RR/mX2tR5JZpgBmQ7fpqPfdFDv:9Kio4n
TLSH
T1F57220426A1582E2D8672B30CA0B1BA93F76C7D5D319834B01DD96308F477CA7EDDA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f1b5.rbs

Path C:\Config.Msi\e59f1b5.rbs
Size 20KB
SHA256 15e06b6255507d3479c7cd57183a541825e96c1b9446ae33f06159cdab86b327
MD5 77da06cedcc97fea852c9a42c7da3761
SHA1 bb1e9903ef4d6ce8cc3eb05b07eed2c19962f879
SHA512 97ec2955581ae0a5af2896d8af018df5e2356741caf0d8b0c2b2ab98b7e262ccf09bbd8ed1f98fd4645a60345cb936193c53d743f43bf3879cae120a96481eb0
SSDEEP 384:hkR3glRjgFfXMawmn28I1S9HXVZFbLQPOsWOBoYfogpETE2+Frft:hY3gjifXMawmn28IA9HXVZFbkPOsWAog
TLSH
T163A2F003A64495D3D8B62B70DD671BA57B32CBD59361434B40EC95344FA33C23E9AA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f1c6.rbs

Path C:\Config.Msi\e59f1c6.rbs
Size 17KB
SHA256 4a65def73b6da2f374b0a7ce824318311c62547d042260dc0a569ab1cb779588
MD5 4c9645722bc3a3749b98dde725f7eb9c
SHA1 ac9bbace49fea1242c17204fe6458586367c8fad
SHA512 494cea160b5522227e62a6ac37df2fcce2c048b8b37f13340b1cab67d75e5132256f01ff5fe62621c3b91279df563ec07d4e1be4aa033d9b4be456c8d469707c
SSDEEP 96:heRp55Rp/NjWT8RFeDd11xQo8RDeDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3TjB:hSRI1GRu1Hn4Xyin5f7e+nh18X0jy
TLSH
T17C82FE42A94096C3E8662B70DD57177037B6C7E5E344839B40EC92349F87BD62F9E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f1cf.rbs

Path C:\Config.Msi\e59f1cf.rbs
Size 31KB
SHA256 e32615052c0b27ad808d6a20cc31aa95a54b93fa92a66e1b134808640838f2b3
MD5 fa14de001140a01c565f61b48469f682
SHA1 1f2cc6d0542191da58d57ca2a68211e56c7d3d0b
SHA512 3e25f8188c9b2864af5e968a92e819de1893c76246372e71b654e7a433a89f6a03f3866d5771988f1431f4689deccd3c100f076b9584bb71ad7747d02e4b1c47
SSDEEP 384:PW8N8BdRYbeRuTu8iu8Uu8XcAlRTMV/ZawBV3yFgmkzRu+Ru2S:PQTYaesaVvRIVxDe6zRu+RuJ
TLSH
T1DDE25402F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f1db.rbs

Path C:\Config.Msi\e59f1db.rbs
Size 31KB
SHA256 051aade3433203cb09b50cc727cc4ae53b52d61fc8e5ba7dc3927bb9734dc1d9
MD5 8efbce16dad5d602a7c68939a8e5bbf0
SHA1 eeab6a9ecf0f158353a7f655ca9424592093ae0c
SHA512 27aaaecc90de6aeae917eef69354adb70af0806d9b7ca47f0ddb27ca84aacd7fc033f9220b40858613861260c141ac2c405fa10f692339585cb4785c11979afa
SSDEEP 768:3iDns5EYuxy1SQBfJsAE6HRzY1WY3BYBYFY7YYYpY2lxlQrnr:P1u2
TLSH
T16DE28207F316A6D2E9493F74C5032B6CBB97D7E5830E064F44DDC8A00E66BC66A6538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f1e3.rbs

Path C:\Config.Msi\e59f1e3.rbs
Size 21KB
SHA256 7f2e9c57e78891fba1599c37997b547205f03c2bfcd51deb5c4e35bbbeb1147f
MD5 05f0b429927d62640142605c3477f6ea
SHA1 4a7cabbbd6cf2cee236608d1b4557b2c90400783
SHA512 b6c656e4021e3dce35e7071081b3d639af9b90a23c9b8dc23b840e1b704d6f78a7a5493a61f09675b749436bb4f157d526e1b6f64f697a35f0a834b409d0fb75
SSDEEP 384:PvyRCGRVnAKxNAUhUC7xJjrMNYPzIbSffUE7oUHIxmHZkP:3CzpAKhkm6
TLSH
T124A20C03768099E3D86227B1DD671BA93B72D7D99350434B10ACD1388F633C72E5AA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f1f4.rbs

Path C:\Config.Msi\e59f1f4.rbs
Size 20KB
SHA256 d01734f87f15b995f50c6b4b4d128b7b465be002c7870eebe147a415b6c44acb
MD5 4f325353fc18d9978beb023142057e7d
SHA1 180fd65fb14e705ada60712e2cbf3d6450d7b715
SHA512 78e23244921a09dae270394e48b0fcdc8ca910dbe3002f7a352c41d84ae8c9e0a508f004cb7b34cdb283ddf2c561c0080bc4c6465c72fc906732df38de13630b
SSDEEP 192:IMRR1kRc15dXcFUADIc1f+W+y4+oAkgC/H7:IMRR6RcTeC81f/cq0H7
TLSH
T17C920B02A680C9D3D8766B31CD671B653B76DBD5A351438B40DC90308FA3BCA2F9D69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f20c.rbs

Path C:\Config.Msi\e59f20c.rbs
Size 4KB
SHA256 90c59fe94a74a4807e773c94e1e5aff3c4901b96283d7ad8df82b4afbdad3d00
MD5 2f1f0f6963e79e564a351badf0861b30
SHA1 527873ac29784c7446fe914ad5aa4d0ad211fd26
SHA512 b301c3ff7bb1d2eb406100dc16220408b10ea56f988acff03bbde4e6a03a7debb0f8a791e2b3a3d4fb83621a5dfa69fc537c3a36a183ecf1611eb46d731307f3
SSDEEP 96:3mKWQYWIHCxStTJ87S/WcWVTJ8/WcWQe36aGmV6m7Aw3Qm0QN:WlUYCcYD1nDQQ9xMo
TLSH
T1D2A198039600D2C3ECA25B70DD17171873B7C6EAD721839754CCA5B44E8BBC5AFE964A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f20f.rbs

Path C:\Config.Msi\e59f20f.rbs
Size 3KB
SHA256 9b403a1d1a635bb41ffd4552dc23f9cea3e8a8f1e79f8bc54e75c6238f97ecff
MD5 c6b3b7d6af49148132dc55f93b531bfb
SHA1 3e27df756d90371a68a62fd63dab40f820a0696d
SHA512 8fbf5112f319e82864a59870553e06f61c5872a19009fbf262826e8d86beb8878bfcb9ecb507c60d41a0b9d20208ebfe52f45273667ded515eaed5fc1990883f
TLSH
T1AE71C142DA44C2D6ECA96B30CD471B2037B3D3DAC364838715CC91708E47BD6AFEA58A
MD5 SHA1 SHA512 TLSH

Submit Download

e59f212.rbs

Path C:\Config.Msi\e59f212.rbs
Size 3KB
SHA256 615445eb2b5aff853176a9c7281812e76bedd1f19e9d46eb2dfb85151f9ac1de
MD5 041c951b7c18159fbf5ed00fe1c60851
SHA1 f5785ab9e8cda1dfecce689347262f1388749006
SHA512 91ccecf4cf6ee1f86e128c1100d3e4627d3cafa81a539b704fbf2c5d8f0da897b56447e4e4db5dec2cf6163830ab16a60725a95306eb0d5f5c99b3af05b86acc
TLSH
T17671CB03954893D6DCE2BB30CA571B143777C7DAD7648387008C92700E477DAAFEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e59f216.rbs

Path C:\Config.Msi\e59f216.rbs
Size 14KB
SHA256 8a3cf0c4d60d829e5cfc872932ed15d5977d40a7b3dd78c4a6bc1bc11f1c0623
MD5 b93ee78daed74f98858f3c0e3a633c94
SHA1 8326d8111c473c8cc76ccd0d8c71682e8df1edd1
SHA512 4ee4a54fb38f5db4f39feebe75db203397ce117c9d2f7df098e74c258a0c19ae2ab8fe2d1c15d5a3fa517aa6a6aa6b9ee1b89bfe403f88ac4b0906269dac105b
SSDEEP 192:uyJXuj2IYcw/0FBCQ1VAkI4VAkJnFEXENNep6F:uytuj2IYcwk2o2Oh
TLSH
T18262E042A60082D3E8AB6B74DE5727143BB5D3DBD391638B08CD91304F837C95F9969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f21b.rbs

Path C:\Config.Msi\e59f21b.rbs
Size 21KB
SHA256 e9f66272b1c331684c4673d7a3169b90a00f8fe00d3e946080d95602e53bcb9d
MD5 db63c56945e6fe7d99e77742b8f5dbf0
SHA1 7d4e68ea7b12c0ff886e9b40e816bf2bbbfadf5e
SHA512 c00a0c5eecffdd5e835dc34d6771cfcfd21f66d32ed243f3fd02b0ffa179950a9887ba13f923e55c02d23654cfe1fb914bcb21896d199e1891826af2eac51d15
SSDEEP 384:7MT8MgXEtmrnb0MM0IE+AfCuS588UkRW+4+B5XDcpq:7MT8MgXEtmrnb0MM0IQ7uF
TLSH
T162A2ED42A640D6C3D8A76B30DE5B1B653735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f220.rbs

Path C:\Config.Msi\e59f220.rbs
Size 18KB
SHA256 38ceb1110e607c36620adc6cb2ddd8d883cee30310ff260c3693de5942b42848
MD5 0d00752eec7b143ddf98456c90d2a2f8
SHA1 e67174cf1382fe2dfe76845efaf261c577c414ac
SHA512 b609928d7176b6932273dea7e2bb71c08f845467d3bb68390aa8b95a469ef4f3fede5b2712dd7c6e8645bbf4615fcb6a0e3cf71ec6b30581adac0a6472490163
SSDEEP 192:7TYbbjrCMyx+HcGpsT0YLjwmYClBqcIFqcIbPHBEPHEoPHk0WpB:7TYHjrCMyxecGpsT0YFqdq1j
TLSH
T1BA920E02AA40CAD3D9A72B74CD4B1BA43332D3DA9761574B45DCC1304F973CA1F9A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f225.rbs

Path C:\Config.Msi\e59f225.rbs
Size 21KB
SHA256 8263de994f6900ac870d021efca07a481b963321aadb77efe8f1fa91c0bf9ba0
MD5 d53ea66c518913d971f02e71716a7e97
SHA1 7f7ddafc7c7992e40de589222716527f32391cd2
SHA512 072bede4a2538f695e210f95b5aa2904965938cfaf4a9cb98895a83ad3ba88c0e7e7ce4cd824f40c70c0779607d1a21b87193381c02d6d07c253c4abf0a56163
SSDEEP 384:szt+2Pny7XRpXEOj84gF/0salckU72eC6dV5ooAoZe10nP:szt+2Pny7XRpXEOYNF/XVepie12P
TLSH
T169A2E0426A10D593D8A72B72CD9B2B643773D7D9E791834B01CC81305F973CA2F9DA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f233.rbs

Path C:\Config.Msi\e59f233.rbs
Size 4KB
SHA256 8e6d151a6c59695a36bc1467697c4d10624b43a91b5843eaf8353967e774acae
MD5 5e5cc59a75f412d6c4ea5288d88da367
SHA1 1230c5e16a6cde22fe983a508923f00d633ca334
SHA512 30f68a7a92c2be3aa39d315b7553bb6aabba743ccd49b349bef98b6dcf3fbad79821826b4f02934828cfe0fecf57f941b0103973763795080942a687a00e6e6e
SSDEEP 96:4sKrwKIHCx36tTFq2236/KcKVTFq22KcKQv+lw+C3+bv3+70rWQ7+0Qx:4rLYCtKyPb1RbQvYw9oP7ZU
TLSH
T168A13B029604D3D3EDA61F30CD07076537BBC2E98316839B04CD91B44F4BBC9AEDA65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f236.rbs

Path C:\Config.Msi\e59f236.rbs
Size 3KB
SHA256 c6f9a22664a9ff74c9d7c010258bb7965a18e22e18990c77a380d6c840512090
MD5 8d57d91f79ce513e56e9e0359a396ad9
SHA1 7097605a992a79f445a51cd4dfc5cd79f785384f
SHA512 a89c036da8a1a15c24e0b854418bb6492cae8133d2c366e5b61af2dbb015abd738793790b31a769d7bcb375b0ed4ea042dde506e8432b01c333f580a3833df19
TLSH
T12971A9039904D2C2EDE63B70D9571B6537B3C7EA8790938B11CC91704E47BC6AEDA24A
MD5 SHA1 SHA512 TLSH

Submit Download

e59f239.rbs

Path C:\Config.Msi\e59f239.rbs
Size 3KB
SHA256 ed251f3a45861e17a077f210c033b9a3e578055870252f05b3ead6f9d63e09ad
MD5 f83f53344a50a318e2898f01bbe4b0ca
SHA1 c826c479ad8078661ff3048cd362570c08e2dbfb
SHA512 b99ddc29367a37f8ba50101538e9fc6f93c1b7cce81196c5fc1d19c251de77c7eb3a3600d603e5c12f712969522dd3ead5f37fa526ced40e3bc3fb72767073ab
TLSH
T1F171C043994492D2DCA62B70CA270B6937B7D7DE975043CB458CC1740E877C5AEDB28B
MD5 SHA1 SHA512 TLSH

Submit Download

e59f23d.rbs

Path C:\Config.Msi\e59f23d.rbs
Size 17KB
SHA256 faa25f0b4fd655a13b0da1690f9f0e494550fc5075276026af8cab7e78e7cb05
MD5 d214b31979c99e99ac40fa3404b04199
SHA1 682734c6a14d928150431ad2b48b59c806f6e46a
SHA512 3c36bd4249d03a33826b67cbfda088ac6fff171d54e99f8331492da22f5ecebbf027f8efad1192492ac7279c3359b994b61c49ff1dc56d3601b448208d0e2b9a
SSDEEP 192:erSK5lJR5UCn1yAkIgyAkOH/EnwNWepJh:erJdzwzFb
TLSH
T100822002A60099D3ECA62B34C9971B683733D7EAD354934F01ECE1744E97B861F9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f246.rbs

Path C:\Config.Msi\e59f246.rbs
Size 12KB
SHA256 be36ce02c0bd0cee8b28870bfcce0bf3f0ae649bb4ce9dc1d370dd0e48e7a742
MD5 d00f5faa6891694023636733c876da76
SHA1 0debc83d1183bedc9f2eaf551e1447c92ef8b47b
SHA512 05e4d754ab437f0ccf5367da2f5a1e37882d0e84c212b748dafeeeb8177e5e4c75a444d943e214563042f2332c8aaf97e4f755f237667e35b41b2d93e7215510
SSDEEP 96:eMNp48xNpM0r7ztH8RDeDwYx3j71rR7c7QNpx0xcNpkFaxcTj7upSxrRjP86CNu0:etR3YwaqrRzfCgPo6fgb/l
TLSH
T13A52F2036B0589C7DDA51730DA231F247B63CAED9324835B21EDE1784F637962E8D98E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f247.rbf

Path C:\Config.Msi\e59f247.rbf
Size 444KB
SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
MD5 a883c95684eff25e71c3b644912c73a5
SHA1 3f541023690680d002a22f64153ea4e000e5561b
SHA512 5a47c138d50690828303b1a01b28e6ef67cfe48215d16ed8a70f2bc8dbb4a73a42c37d02ccae416dc5bd12b7ed14ff692369bc294259b46dbf02dc1073f0cb52
SSDEEP 12288:/VHbDqy90l5yQBggQerfhUgiW6QR7t5ss3Ooc8DHkC2ehSxPA:tbOqQbnrMs3Ooc8DHkC2ehSxo
TLSH
T12BA45C237B864CF2D19E53B231C9531257FAFC6541A1F303ABEEE1593FA6286E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f248.rbf

Path C:\Config.Msi\e59f248.rbf
Size 948KB
SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
MD5 2fb20c782c237f8b23df112326048479
SHA1 b2d5a8b5c0fd735038267914b5080aab57b78243
SHA512 4c1a67da2a56bc910436f9e339203d939f0bf854b589e26d3f4086277f2bec3dfce8b1f60193418c2544ef0c55713c90f6997df2bfb43f1429f3d00ba46b39b0
SSDEEP 24576:wmFyjHVMxBuwQLYucGp4iiqgNb3HoIbiIw:2My2yRgFoIbnw
TLSH
T1BE25BE12B982C0B2C57602B1152DE772197FB971443684B7ABD98F0E1DB46C0FB6BB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f249.rbf

Path C:\Config.Msi\e59f249.rbf
Size 331KB
SHA256 c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
MD5 69004e08c1eb19fcf709908103c002fd
SHA1 d59459f9a18b2e9a06e5af2b88f4fecb0ce690d5
SHA512 3fc67a5fccb252a67285e19d62057fb4e3c63e702f4be91e552f93d9827cc746b8fb43b4a3b24b7fd5c48832d18a1dae26c1bd237f40b7b88618d402fdac1a76
SSDEEP 6144:+DyAKCgU1ninuWLJ/Coq6ElyFkc6csYR1wo:CKCg2uuWLJ/CoqHYFkc6Qv
TLSH
T100747D31BA85C07FDAAF4331645EE2BD20B47651ADB1C143BBD89B2D2BB3A42D431D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f24a.rbf

Path C:\Config.Msi\e59f24a.rbf
Size 242KB
SHA256 1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
MD5 c7739dd4212d084d299df68f0a0debc3
SHA1 cba81d847d91bfea5c03279c0ca03fb1aacd4ae9
SHA512 5b8e98e6764460f9afbfa6dd34c12ad59284003eea99997c9e1db9b4a85ba30ac8b6a699b2888388dc424c547918137d42984bf040ac3d292e612bc433368fb3
SSDEEP 6144:3SsS5fv6EATwqlGwyfDyodYI3ZubfW5Ub2PQu0+0:3I5fv6EATwqlGwyfDyodYI3ZwXh
TLSH
T193343C1272A0C9B9E57E16359B90A764605FB401CEE2E67F7DA88B0D1E713C0AD3472F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f24b.rbf

Path C:\Config.Msi\e59f24b.rbf
Size 117KB
SHA256 62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
MD5 90419039c035404fb1dc38c3fb406f65
SHA1 67884b612d143aa08a307110cee7069bddb989a0
SHA512 e632c78c941861e61fbec68e333e6549cd4bec683593db92c2522e162176bd64160dba37d4226c1599cfe1d77b36d5d4c452dd2f453c291a15310dfb607f3414
SSDEEP 1536:UzysWjcd7xOvGRfXQFXqoRL47Ng2a+0zf5Ld/k1D0/LS+HDzV3g/LpL9qFEB1b:Uz97RkqI47eLhLdw0bHDzV3g/tpqFErb
TLSH
T117C37C01B2F08075E0BB0939AA75A6225A7F7E735AF1D8972F88445E0DB07C1E735B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f24c.rbf

Path C:\Config.Msi\e59f24c.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e59f250.rbs

Path C:\Config.Msi\e59f250.rbs
Size 26KB
SHA256 9c2a6fba9efb9be181fe4c827fbf136e6a15b4617a899574b099c4b3e17d3ca3
MD5 93b68cf2b9d57be4709c2f2247bfdf3f
SHA1 4c3ef2658d1956394b42470419d4ff4604edefbb
SHA512 ae66e0e068a9bbf224f30c2a1f0a4cb9f6250ab15f1959dfb46521abb42d3246f7ac88e32464c9a7ac7fdeb36850e4e1841a2239e3ef62e0a35b21b018a96aea
SSDEEP 384:8YdSJ78APJMkURQRNIFK0cWxFL+L+YT4bV:8XJhPJMkURQwFK0cWnSm
TLSH
T1EDC20D027B0092D3E8672B70CD6B17297B72DBEA9711834B05DDD0344EA3BD52F9A64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f262.rbs

Path C:\Config.Msi\e59f262.rbs
Size 21KB
SHA256 7347743d30d17e7dba28ef6e0abe751a87b6669a3435b4efbd1cea51c845aad8
MD5 5b1eafc2e5556123cb31b60cf0d8d774
SHA1 f47000dcacc3689740671daa8b8d80404f399fbb
SHA512 69627b928ded8985d976e82090904fa7d1a99b9ae4f3ebcf2340dfa6505403fe883a20a7c3570eda617f6a2aaf49b971381ac8eae5f29487b4aa84565ea766dc
SSDEEP 192:8KRiYPaAGQjQlXS7icYQhaeZrwqd/UscVuvx/B:8KRiFQjQlXS7icYQhaeZrwUWuZ/B
TLSH
T170A2AB02B75092D3D8672B70DD2B1B263B76D7E98321829B04ECE1384FA7B952F4654F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f263.rbf

Path C:\Config.Msi\e59f263.rbf
Size 45KB
SHA256 5e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76
MD5 2f7c88c43a8966882ca89ce4981e3cde
SHA1 588bdeae6eab1f447771bd6963b5b3329196e686
SHA512 3f2eca126fc821e36aaf4430a0f41af1a060396f52cfb2efd1c3be2ab9d69cfac870121c646776c8b15e8561938ac30367bc5687bb9a79f0c19156c3b56249a7
SSDEEP 768:ddzvsXyPptLkrHyTby9XVLc9iiKrEBqrz:rz0XyPptLUHCbyBVLS+EBqX
TLSH
T119234A761BB8CA47D611453046D2DB83BB38E7995A11CF0BBF01F68E082A755FF09E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f264.rbf

Path C:\Config.Msi\e59f264.rbf
Size 45KB
SHA256 9eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe
MD5 70bbafa7c8b0aeba0e25e27c440a6038
SHA1 44a5e06229ae4f6ce6d3b2b57cb3b6050667def2
SHA512 2e9b8696c1b4ab8e721fa07b6c81fe30613f0d188250991c573af95263688b7db6e25ebc4c030825724248c9713d9c5b772f199369785ac615ad2d2fdf527f8a
SSDEEP 768:oWbfucVI4Yr7kn4TJVM3i/EhKd9iBSEBWkR:VucVI4Yr4noVM3XhKf3EBWk
TLSH
T19223297A07A4CB42D9514A3006D6CBA3BA34EB95AF008B57BF02F6CD5C59385FF19D28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f265.rbf

Path C:\Config.Msi\e59f265.rbf
Size 73KB
SHA256 550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8
MD5 09936f1f2ad5ae9d0663b6e8709527c7
SHA1 f0e5945663e65405d94c394db83880f713295104
SHA512 3e95e1e3f2043e1f0a4baf1267e82f912bcd5830ae6c5abc750a38a0666b1a6b9e1169dadb58bc2eafae00a2e11bcf574ea805f3a1f07f77d5450d1265e8e7f6
SSDEEP 1536:fVPidQr0UZqnn0BDw7Pu6V4aGCWRZ+e0petNSaQhp0vcsjsr8gWt8C1dCuf94uEj:fVidQr0UZqnnSw7Pu6V4aGCWRZX0bhpN
TLSH
T10373BB6143E98A19F2F2AF746EB45390BE32FDE6BE35D60E5610618D0871F40DE61B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f266.rbf

Path C:\Config.Msi\e59f266.rbf
Size 63KB
SHA256 d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613
MD5 9becefa155c8c9f5ef5bf9d537c0a258
SHA1 4f33f6d08685d50ce799df6369cb5efc51673e12
SHA512 5e9972cfe26c0fc6a0ea38643c644b5ac33e4ddfc1cff5b25017c81f3121ec7732565554f43c1916e9f8e2b1d84226aacd2cc4d6805425c2f1f1e7683e506ff4
SSDEEP 768:yTijcBEhCgyPj6B1CLPLNq5f/nWHBNheOU2fd5s9igOm27EBmoU:yGzfyPj6B8PLNYf/nWHNTdAhT27EBmoU
TLSH
T10C53DA6263FC4605F5F77F706EB586615E3ABCA2AD34CA0E1650A14E0972F40EE60B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f267.rbf

Path C:\Config.Msi\e59f267.rbf
Size 72KB
SHA256 87e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a
MD5 30281f2891b6deae8c0deb122b5906c7
SHA1 43ed0c7bf45839ba07501c1013ba74c97b4d0beb
SHA512 cb0e3f3cf89af55e4b849b3f4f883d8348fc8f806690db4fff238ee54bc5f80a34e53c7e8a22dd9d1dc57c1a60c69d3e25ad9cc52ac66628613cdf358e7aa537
SSDEEP 768:iqj0KnBU60E6rg/PKuCOCF3OKWRElJRZRIvp99idASXEBUoG:0wq60E68/PKuFm3OKWkRZRIl+XEBUoG
TLSH
T1F273825117F85206F6F3BF34AAB94A955E3BBC96AD39C50E4610618E0CB1F40DE24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f268.rbf

Path C:\Config.Msi\e59f268.rbf
Size 73KB
SHA256 b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2
MD5 b41aa9a167ac3d6c11b5c2e1e183c11b
SHA1 ac8efa5f7b8211e4dc0d0d0e6bc7717f88d2c0ac
SHA512 de667f1fe0bcb0ddf8f59054a2d5c516ec47ab59f7e78e29ec8a2cc756c72aae65bb73ea03701c67c978166649d69278fb0269e9588d968f630165bcfa6f40f8
SSDEEP 768:I26iNYajZELpjYImN8YxAaTafCp5eFQZmZUjyyyyyyyyyyyyyyyUGQFUbWo2Ne3j:INuqLpjQA2SCHj0jL+TEBeRE
TLSH
T1E8736F1163F89606F6F27F3069B846555E3BBC8AED35C61E1A00A18E1CB2F54DE64B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f269.rbf

Path C:\Config.Msi\e59f269.rbf
Size 71KB
SHA256 271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289
MD5 2bcf9a28e5fe7a3fefd16a9c03d35dbb
SHA1 7c1446d8ca4d2c6890d62c02308daccb8be5475f
SHA512 445ef027eeecda4361834334706079053ce9a735cbeeadaec37f28c4f9a485b07ba156178c2cdb1f012d1760d0495d041deceb6372921eb94d18241eb304eafa
SSDEEP 768:S3E6XaCyqbK15Md+igDGxNIlW3gyCQQQjeqS1hDsiiUWTV99is0EBnoX:Qass5Md+igSxNIlW37oETVx0EBnoX
TLSH
T10C63952263FD4A09F6F3BF306A7996515E3BBE56AD38C50E0650608E0872F54DE60B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f26a.rbf

Path C:\Config.Msi\e59f26a.rbf
Size 52KB
SHA256 43cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407
MD5 34b5ae129703de4a4bb5f52f4306fdf6
SHA1 601ba6cc73cbbe6d7014519a885fde2c9e9c2fba
SHA512 016dae93356e42a19f4fb4d34efa04e93f802e5de3157c29ce940d9637d697d2b7a4f61b705b5b5df271b97d942cb81265d0fe7c9561c0ef3c46c249b8b7fb9c
SSDEEP 768:s8anVn/ZBtJxtr10/euKRHIWJ9i/wEBC1gnY:s7np/ZT/uMRGwEB+gnY
TLSH
T13533D7DD3AB8CA07E0E2C5300190F6D57A39FA449AA18E132F48F64F54566CAEB15F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f26b.rbf

Path C:\Config.Msi\e59f26b.rbf
Size 52KB
SHA256 32dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d
MD5 f89147c034de186e3ab79326523888b8
SHA1 d3e6c00363a429eae066953f7c187e33c687ec6b
SHA512 d7842681f67b46f67233ad0f7c57c7155f152dc25ef546a08fb91914ee54984b87f9ccbd8da3e40d012b251fffade838f2d779681afa84c383ea7982f0ad1cfe
SSDEEP 768:rCzO54LQTNyDraHniJNB2I7CvqV9iqoGEBNt1R:r951TNyiniJv2I7Cvq3xEBDH
TLSH
T111332A6716B8D903E4608575A7A3C7D7B7399680AA238E07EB00F2AD146A7D4FF10F5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f26c.rbf

Path C:\Config.Msi\e59f26c.rbf
Size 69KB
SHA256 1154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67
MD5 d7f2e87512d19d01328840187fc7cb04
SHA1 7a312b677b76d7303e01da6064f1a5e0fb26c604
SHA512 8a00cae2dc0d59e530cd43bf84f33301f53ccdd96477787805b487ffdf6869223621414cf180a1aafb6b8910ba19684c02c60226a651d051eacc4cac1fbd8c2b
SSDEEP 768:pq/gFXOvijuqN9TMIVhtZ3FckD+Sy9iOLEB6C:g6XOvilhTVk9EB6C
TLSH
T14E633E5FEA7CD211E854C2701F9289D7207AB710672986CBDA8FBDAD602D33573285CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f26d.rbf

Path C:\Config.Msi\e59f26d.rbf
Size 4.2MB
SHA256 6130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15
MD5 293002e4332f01c74c2a843b5c638a90
SHA1 2e412f945ac4353b4908c87e31b847415b3ec19b
SHA512 49eaf5633debad535ffc6584c8383e21c99f7a3a81a0b3496943af0e79853399649706ceda9da9990c259d605ab163c22c08f641b91e80c8a14d519837a595ce
SSDEEP 98304:Gn+PuDLXJzBhxHJRAbQimwTyY04gXZDpxzecFLOAkGkzdnEVomFHKnPLO:HTyY04gXFL9FLOyomFHKnPq
TLSH
T1E026BF227EDC40A9C66F13319E6A763C66EFFE906835065763583F2FED712016A2D123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f26e.rbf

Path C:\Config.Msi\e59f26e.rbf
Size 4.2MB
SHA256 68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
MD5 e1629a36f15824346bb54a9ebe9b622f
SHA1 ee5d55315ffb351e24b7c918c82e6ce4ec17a645
SHA512 0301ed7ad473015478f32afd3e41dafd045eab26ad42080bad6030324564a7ed09a7516b8d362b5cb2201d087eb25f2bb7ac5fc809a387f49f893ac3df8814bb
SSDEEP 98304:0xNPc+4cnKyGatznwFDB0i+9G0eBF/8jFLOAkGkzdnEVomFHKnPs:r+9G0eBF/6FLOyomFHKnPs
TLSH
T13626BE02BFE980BAD66F13314E5D773CA6EEBE94E830474722543F2EF9712026929157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f26f.rbf

Path C:\Config.Msi\e59f26f.rbf
Size 81KB
SHA256 8c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187
MD5 36ca9bc41425660ad80f23933e6e9f1f
SHA1 3206186f932cd5948062a837b5fc2094ddb1c8b7
SHA512 a58eee2824bad90ea0790bdf55c5b58a6eec5f3e87bebf5a941a6dbcb8106c6d96b7eee0a022c4a16f35d80e38501fed54d88127f30de0e9fdd22e4df8fa2ea5
SSDEEP 1536:GTF//j3V4q90rz6ggkZZKMXKq9Lf517jSEB4gn3:u/j5s6ggkZXXKsLf517uESA3
TLSH
T1DA838D45AA79C9BBE68F09327E6AC8425935D7D3AEB1FB031501E7DD5C873C09328386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f270.rbf

Path C:\Config.Msi\e59f270.rbf
Size 81KB
SHA256 d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a
MD5 9b73043d5646be7b544e3ac3d49b7744
SHA1 a3eecb1a85c244d5428a012041eee947462e7a09
SHA512 8f339c23f8d1e8eed1bd055a31c027e5da03d916769468394ba1befe7b4f2586e67e8dcf29326ff40abb0d879a45f886398d5d733c988c507860d1ece16ed83a
SSDEEP 1536:OAwg6/MxolUL+gWccikZZKzpUL/ybAGEBPiSe:k/MxolUL+tccikZAOL/ybAGEwv
TLSH
T186837D45AA79C9BBE2CE09323D69C9465139A7D3AEB1F7071601E7AC5CC33C093197C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f275.rbs

Path C:\Config.Msi\e59f275.rbs
Size 19KB
SHA256 628b24cc1fa09975e4dd7e4ea02952f8826f2cde595064853e7eaa37f363aff9
MD5 6841b319cc1a5d719889f4056cc38398
SHA1 8c520797d904a1b05932108ffb945d1c50365db3
SHA512 99bea0fa39aa3bc6bd1bf476e6668d040b5650fd3fe9f65e55c8c6f6bb5d87ebc250e83b26ab1bf374497aa936663abcde7393787a8557b901c4b70f5544b30b
SSDEEP 96:abRpvnRpxxDu/AD15doNNNNNNNNNNjrOJDn4RnHVNRpI8BpRjWRZeeRpSGCXP0uR:aeAULGRlCcBgcIPgcHuGxjn4E0AykWpi
TLSH
T134920E02A644D5C2E8A23B30DD572BA47773C3EA93155B4F45ECC1309F573C62F8A64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f280.rbs

Path C:\Config.Msi\e59f280.rbs
Size 20KB
SHA256 e50b07f74d32028e8a43307edfd8416e57aacfcbb83304c05806de3994260327
MD5 c89fed985e22776dce35e303bd033c25
SHA1 4c7cbe15338871a29fe051180a43b2bbbdca81f3
SHA512 7f5155f18bac2e56e76a16322a52d81f412e2b11e4a6346857334f659c0e061b57bd742e563a961ba9a88b3126d1ae57b5abcb46543dcbe27f4f8670308bfe9d
SSDEEP 192:IpJBe7Uk0Ve2SD4QsUh+MtdRXCPB2pDcI12pDc5XMEBWmLsLE+KmSOO3WpsM:IpGYk0Ve2SD4QsUh+UOItIc1XQ5SOOq
TLSH
T17492CD82AA44E683C8A62B70CD675B243737C3DAE755974B01CDC1304F977CA1F9A68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f285.rbs

Path C:\Config.Msi\e59f285.rbs
Size 1.1MB
SHA256 a31dd261c8b9861c16715e9b1f1352960d73461c212a785ebbc1718161eb2751
MD5 375fa580d2695ef201fd1b4a2df958b3
SHA1 ea8e37d781a365aaba7a53722c60fa59dc5b6639
SHA512 e3557e87c8c77ea30871bc9d25971abd3f7dc8a08a507542e28286968b9028c29e3483d140f2e0473fb3a1ff82de812c39dbeb4f56fbaa5ecab9929aedda5207
SSDEEP 24576:vBcMBe3eVbfVhwXDpUpPIhwXDpUpPChwXDpUpPthwXDpUpP3:4uVRhwNUxIhwNUxChwNUxthwNUx3
TLSH
T19835074173E44175E5F3AA38D9F24A16BB73B8525B34D3CF0254862D0E72BD0AE7A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f286.rbf

Path C:\Config.Msi\e59f286.rbf
Size 44KB
SHA256 b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e
MD5 bc959a160882b0de0583047b1b5b93a6
SHA1 78bda837a0fcc25623b54e95f3eff76c3bd79332
SHA512 7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd
SSDEEP 384:sA4dzYZj6Tt3jmpuXkGtrfK76lNWg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+7n3n:sHK6TtMGgpFiJi3SYDw
TLSH
T11013541C97E70712F2B34A719AF150C24ABEBD03BEE6E77F9B45030944616884992FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f287.rbf

Path C:\Config.Msi\e59f287.rbf
Size 41KB
SHA256 4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806
MD5 91ceea551937cb5da627f33ef7995ee8
SHA1 4e7483605c4027381e4796345f0a0e6aa9342a5b
SHA512 2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9
SSDEEP 384:XKBk39BmxOVst4SCtrpuXYa1pbr/0K7yKKJ9Yu6dnPU3SERztmCJMadMardz/Jiq:XKGfZs5CZqljU6rqnuqzeEfViIF
TLSH
T1FC13B529D3F84712D2F74BB16CF1A4835936FA539EB8DB5C149A530A48133D84E62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f288.rbf

Path C:\Config.Msi\e59f288.rbf
Size 76KB
SHA256 972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867
MD5 7173d17aa9ff4cda07fbfff21a584a67
SHA1 37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc
SHA512 b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167
SSDEEP 768:MTcr9yq2UX/RPLYyODdyoSNjSvYomC+L8XW/FuhyINGLTGnBEPzfsTKJzePDFiJg:9dVV8XW/FipNGfGBEPz0ceceimOU
TLSH
T1AD7385189BFD0722F2B30B71EEB684C15E7FBE277912D61F5508414E2491FA488E2B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f289.rbf

Path C:\Config.Msi\e59f289.rbf
Size 35KB
SHA256 06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39
MD5 da7787ae5278031ef79441d29599dcff
SHA1 4e2a4c70035808dd8bffaeb6ded8fe2980566e0f
SHA512 2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e
SSDEEP 384:neght+fMtSM9jmxa1CFbfKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3hW8zNWZQ:egX+EtkqR6rqnGHKoVijm
TLSH
T181F29529D7F84712E2F347B1ACF684836976FA13AE78DB5C14C6534948137844A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f28a.rbf

Path C:\Config.Msi\e59f28a.rbf
Size 35KB
SHA256 b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa
MD5 86a1d818b679edbe94ab51b963ba79a1
SHA1 2b9ee6b54aa2f709442e7e514335e2548c933318
SHA512 ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9
SSDEEP 384:6kQOJrYa7mdessomj5R/yeizfa19xrwKJ9Yu6dnPU3SERztmCJMadMardz/JikPg:tQOVYoxVUqzD6rqnz7AWpLrFVieG
TLSH
T1E2F2C628C3FC8326EAB34B70E9F594876937F513AE76C7AC1499530D08227944523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f28b.rbf

Path C:\Config.Msi\e59f28b.rbf
Size 21KB
SHA256 0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956
MD5 6083b2909a6c1ab52ce84da1b435e7cf
SHA1 e851ccddf1fcb0c2fd9cfb4a357f72633452f240
SHA512 53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1
SSDEEP 384:WK2RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYW:TurKjgEnGEFiJrvPA
TLSH
T1C6A22628D3F85721F2F34B70ADF284839973B913AE79D76D2586030D0866A449963F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f28c.rbf

Path C:\Config.Msi\e59f28c.rbf
Size 24KB
SHA256 4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb
MD5 d87310699e3baac5ecc0f64673fe3485
SHA1 34460b0eb74977b98d9d3e683d5ffa2aec11059c
SHA512 096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38
SSDEEP 384:CZp0wdaXOa1FOKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81LUWIYj3gWUXRm05:Cz0Ka+qb6rqnDnOVi+t+8
TLSH
T152B22428D3F85312E2F38BB1DDF58487A976BA53AE35C79C2596134D08227844963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f28d.rbf

Path C:\Config.Msi\e59f28d.rbf
Size 280KB
SHA256 a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b
MD5 a3ae8e892e025e479978fb07fb449784
SHA1 71a1641ffb0da859af5e355c5bf4a9bcf1746e74
SHA512 e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54
SSDEEP 6144:Z/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvd:+777376V7777U77aPMKIXaXce7mNTp8Z
TLSH
T19A54F8A6A2E84F22D3FE037920F1554B09F1EC17D64EFB4B684082F56C1B7A09A63D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f28e.rbf

Path C:\Config.Msi\e59f28e.rbf
Size 108KB
SHA256 6e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6
MD5 1c8e5ef9f86430fbda800e45c0a89aa5
SHA1 4e18ee249a208dbf7d7b52d412fa0d402fd3ff2a
SHA512 721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66
SSDEEP 1536:64OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQns:6rjoi6vdu0Ow6tKGfU+IN93s
TLSH
T1D2B31A1093FC4721E6F70BB57DF6A0418673F9229EA3D31D1959060E1826F948EA2B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f28f.rbf

Path C:\Config.Msi\e59f28f.rbf
Size 152KB
SHA256 a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036
MD5 6742f826c21773c933fc2a68ceecb99b
SHA1 dc689d3fb31e7cab6a33cd2192d6114542173514
SHA512 4138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a
SSDEEP 3072:Z0anyn/CiBk6HOIz42IJqFF/0/WAWwerjeVPt:Hn+Va4k
TLSH
T12CE3295A63EC0716F6FB0731A8FA54416EBAF8032966CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f290.rbf

Path C:\Config.Msi\e59f290.rbf
Size 140KB
SHA256 35cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a
MD5 cad14a2ced4a556139097c1f716eae70
SHA1 9552115b645c17165bacc2231725b3f8073105a3
SHA512 df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331
SSDEEP 3072:wAyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcj:wrIMFRuf
TLSH
T1FAE3281963E81B1BF2F70734E8FB00824BBAB9077967D71F694E41CE05A1B844662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f291.rbf

Path C:\Config.Msi\e59f291.rbf
Size 189KB
SHA256 f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57
MD5 1f50737bb92b1f71b15824a0f113d3f9
SHA1 4d78793ea921986d011a024b91ac59d6c02de6e0
SHA512 89e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4
SSDEEP 3072:Lcs+QnXsia21rUBJeImxRGluQriZy+GZ7X/kMIJo:LcsrRIHiYYK
TLSH
T1CA14192467FC1B11F2FB4B7AEDB5A0019A76FE662D13D31D15A0419E1872B40CAB2B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f292.rbf

Path C:\Config.Msi\e59f292.rbf
Size 76KB
SHA256 dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361
MD5 d68368708be2b6dac797743e23dbf655
SHA1 e843b858d72359ecf6fcdfca328ed19a7f23210b
SHA512 2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e
SSDEEP 768:nI/327083Js1D8z1bKta9mqfVD20avQwiubnW2yCzT/8yA:nI/320UJsbta0qhRwfLyCzj8yA
TLSH
T17973F700BBBD4BA9D1FA0B7AA8B990109471FE557813CA1E0E94B14E54F2F90CEB1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f293.rbf

Path C:\Config.Msi\e59f293.rbf
Size 428KB
SHA256 13f36534cf603cd722ac9078e51930cba190395d23d6688b65a8c788262759e5
MD5 9e877ffed2e2c9a013c59581f88786b5
SHA1 d3bbb3e2c36520ec267463916d3356bf4fcd8037
SHA512 5b4ff6de141bf2dc321dfa05fe8c93f64ca91eae6b41041264736c3c6db9d0520c135103873c5f32a47c742fb51317b3303e7656cd259331113f9b876ad17613
SSDEEP 6144:7Nu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJP:Zu/UT4HQ+hpxK1/
TLSH
T1CE94E71023A88E2ACECB0275E45BC6158674DB0A76ADEF5F5DF5E2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f294.rbf

Path C:\Config.Msi\e59f294.rbf
Size 292KB
SHA256 d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c
MD5 bc9a83d77cae33f9eb9bd538ab65b2a1
SHA1 363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8
SHA512 37ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57
SSDEEP 6144:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfM:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvZ
TLSH
T18B54F816277C4A2FDA6B0674F5B2067106B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f295.rbf

Path C:\Config.Msi\e59f295.rbf
Size 128KB
SHA256 c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef
MD5 c7fc5f01de9577403a1ea8aafad79e72
SHA1 6422fa355184394ace02c0ba88e5b8af3db7fa6c
SHA512 b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87
SSDEEP 3072:HEmV8EKUaX1IrJeE+6pwluGCulHxTqo+Ue:HEm5azUaxW
TLSH
T126D31A01B7FD372AF2FB0B79A9F96001C97AFC556A26D78D1851424E04B5F808A72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f296.rbf

Path C:\Config.Msi\e59f296.rbf
Size 92KB
SHA256 6e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5
MD5 535d9d8441e0e22aa3f407c7197f8a0f
SHA1 ec6d047e975c107a7ecdf78bf352a5a68f53392f
SHA512 f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e
SSDEEP 1536:KJr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016:KJi6vPUL7zxwXmh8Gf99XZ
TLSH
T1CA93E82493FC4F61E6F71B742DF6A1814A72F9625EA2DB1F102D410E1D23B948972B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f297.rbf

Path C:\Config.Msi\e59f297.rbf
Size 356KB
SHA256 8186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090
MD5 5e1a793d9615d4d9e153ee416abc83ad
SHA1 27d231f4d1e2b473f9695daa21b22804db779826
SHA512 f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876
SSDEEP 3072:JBijFKiOKL/u3RW1NvAbugFh/jLqthte2Seh6GVa5DU91Tp01sq9kAaCXrmRKHpH:jIZrvgQKA91TnAa+tPvH
TLSH
T1B774C62073F95208E6B70B30AC7651C51A77BE67BE15C62F2449324D6A72B938B23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f298.rbf

Path C:\Config.Msi\e59f298.rbf
Size 352KB
SHA256 8da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296
MD5 03898441f5d9a8809c04fe746fd498b3
SHA1 35cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6
SHA512 dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12
SSDEEP 3072:DAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Ex:DAikDFsY3IYU+uojT/xK6ur6EaPef
TLSH
T1D174C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610E1871B819A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f299.rbf

Path C:\Config.Msi\e59f299.rbf
Size 82KB
SHA256 33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a
MD5 f148286b321ed09c2d17e9e3637c807b
SHA1 b0928429f52028b512dad9c7e0996ee7ade315d3
SHA512 d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b
SSDEEP 1536:mkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79WShdMUVV:mk3gCbzexZG0YUBXfqidZhdM4V
TLSH
T155836B17A3EC4B13D3F64630A8F09A03AA71FAC37566D79B30466769089B3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f29a.rbf

Path C:\Config.Msi\e59f29a.rbf
Size 41KB
SHA256 27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db
MD5 e3c8239a97601bb203b9e9037eed89c2
SHA1 75f0e5f417477d4c491e8ad81f498faf761618a1
SHA512 71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2
SSDEEP 768:Jc1JB9Xaefxf2ZquXoQGaHQ6rqnig3qTVi:O1JHXtp+ZquHHwig6TV
TLSH
T1FC13D72493F80323E6F347B09DF194839A37B953AE25DB9D1099574D0812BC5CE62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f29b.rbf

Path C:\Config.Msi\e59f29b.rbf
Size 76KB
SHA256 e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457
MD5 219c69df0c23fdaf84e4c9ea2835a628
SHA1 d3b091bfcaa8506d299cb1d7453fdce7fb27dafe
SHA512 e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8
SSDEEP 1536:SdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHN2gxyVu8:4YR63P8dlNGu1IcT7TXLqbgx69
TLSH
T1B373291193F88327C6FE43B564F0A8125FB9F653BEB6E71D0885939A48537C08D52B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f29c.rbf

Path C:\Config.Msi\e59f29c.rbf
Size 80KB
SHA256 5a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d
MD5 75e8bc00ad7da1e7628f146dc33cc83a
SHA1 b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e
SHA512 b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3
SSDEEP 1536:4Uy56bAm4HNNN5AU+QO2TFvKe/elIQcmEtli/G//ZgUKtmOo:Iu4HNNNmdy9EUIG/qlY1
TLSH
T1B8831A1993EA4B13D2FA0B7898F154C24BBAF5037DB6E72F9A46124E04933C44962F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f29d.rbf

Path C:\Config.Msi\e59f29d.rbf
Size 48KB
SHA256 e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f
MD5 775dac5f81248b14182c82013672c42e
SHA1 cef7bba712b25da04f60f597cb614c7e4b87f24e
SHA512 2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c
SSDEEP 384:Qeg/3V8jOAfSr7CgWzwL4/7y24p4kwo6972IbL8J717lw2Ghr49gpWg67KGhJSxl:V6l8HKAMs/+24E7r8LVGUFiJzFDQ
TLSH
T15323321C9BE75323F1B64A71EEF145C24EBDB803B9A6A73FDB451608089368844D2F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f29e.rbf

Path C:\Config.Msi\e59f29e.rbf
Size 24KB
SHA256 db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236
MD5 2a9b706d83be29f32a28f29be397e533
SHA1 31135de80dd7b7c4a27516806fbbb13d871548d9
SHA512 cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64
SSDEEP 384:w3K6a/IZa1nKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CmWbzpWZDzDm0GftpB/:w33qA6rqnLPAVip
TLSH
T1ABB20428D3F85312E2B38BB09DF5C487A977BA53AE39D79C1496134D08267C44963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f29f.rbf

Path C:\Config.Msi\e59f29f.rbf
Size 36KB
SHA256 f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b
MD5 bd3e2c28c647533a057b5cdf8bff2c5f
SHA1 d36c80e460c5dde615ab1c268bd89309225ecb82
SHA512 14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc
SSDEEP 384:NQK7QQZbXvJ5qCmIG7g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+G6reVxW8H7W:JbxjG7FiJH6a1
TLSH
T103F2AF1C8AE70652F1B24F70DAF140C25EBEBC137DA6676FDB4607090C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a0.rbf

Path C:\Config.Msi\e59f2a0.rbf
Size 52KB
SHA256 9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4
MD5 63a1e9cde10490008ba7ef47a12179d1
SHA1 5299af182b7cf08f95fcb3815149d7c54e73187d
SHA512 dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe
SSDEEP 1536:oy8H8QhPyUv8whq+927kgF1fGguNnJKIZ6:fZT1fGfnJrU
TLSH
T10F33C81897EA4722D3F70B7198F245C24EB5F803BA77E79F0A4853491C52B848D92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a1.rbf

Path C:\Config.Msi\e59f2a1.rbf
Size 36KB
SHA256 19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b
MD5 7a016cec8851a57b2f0376ae6d1fc837
SHA1 f161f9d8d7b073c1f17f55719c37124969bd7d2a
SHA512 f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456
SSDEEP 384:Q5Qndl5IG9g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+GwE/778UWj3CW:eG9FiJHF/cJ
TLSH
T187F2BC1C8AE70752F1B24B70DAF140C25EBDBD13BDA6A76FDB4507080C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a2.rbf

Path C:\Config.Msi\e59f2a2.rbf
Size 64KB
SHA256 0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7
MD5 4d4774a30da56119888490cdf3157b09
SHA1 360221725daa9b7a14460fe6939d54b2173fb8d1
SHA512 eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130
SSDEEP 1536:9pvk2mCtNGNMGfRfESSgOX55uKG/SmawWQie:XkEGfR8SSgOX55uKG/SmaTE
TLSH
T10353B508C3AD8322E3F607316DF186825E71F5437A39EFBE0946375508AB7C46562BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a3.rbf

Path C:\Config.Msi\e59f2a3.rbf
Size 62KB
SHA256 c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1
MD5 9002a577c07ab2b99979435cd8b67acd
SHA1 5b3c6231c113b726ddd55fd8a8e3ae84b1526820
SHA512 f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47
SSDEEP 768:mdgc7HHzMKqYyb6FZZ3JEMTt924zM8X79qZI336rqnbsWraHngVinE2:fc7HHzMKpyGZ3Jr249XJqZqtbkAVQR
TLSH
T1E2530814D3F88723C2FB87B568F148839A76F743ADB9DB5C1486532A04577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a4.rbf

Path C:\Config.Msi\e59f2a4.rbf
Size 61KB
SHA256 241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec
MD5 218e31b07c6e07633a84f0248730e220
SHA1 47ee36529b741f3d52c487e6dad151f516c2eb5a
SHA512 e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0
SSDEEP 1536:ran8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsNjNPBDWGVb:NMPG7wqhDW+b
TLSH
T151532918D3F84323D6FF87B8B9F195435A36F843AE62CBAD188A538905533D44913B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a5.rbf

Path C:\Config.Msi\e59f2a5.rbf
Size 81KB
SHA256 ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650
MD5 93030b5af327ece3ddc3518410e1af59
SHA1 4be27729a906169d2afcf025e10f308fce35056c
SHA512 247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d
SSDEEP 768:PVQ+jyq2UX/RPLYyODdyoSNjSvYomC+L8XW/By/g6I+wVtB4dmg1ZqnBEPzmhK7x:S4VV8XW/Og9NCJ7qBEPzmW2yZAW7KVg
TLSH
T1E6830955C7FC4726D6B74B70F9F78446A633F967AE23C78D1408824E2851BA484E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a6.rbf

Path C:\Config.Msi\e59f2a6.rbf
Size 200KB
SHA256 ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8
MD5 c30dfa5fbf9f2e6d18ceb7108923fdfc
SHA1 523c4b9043cd6d722c01215f64173b9287623d76
SHA512 075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2
SSDEEP 3072:20ZVVxFlfJ57iPki4i14IBkb2/Demjzk27wxqWSDsKnFp6/M/CP15rFJgStL+L:t5Pu4M4IulbK3C6
TLSH
T1D0144B1663FC4726F6BB0B35D8FB11026E7AF9172967DB1C2889068E0971B809973737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a7.rbf

Path C:\Config.Msi\e59f2a7.rbf
Size 197KB
SHA256 19e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501
MD5 fca2f9f00de26d0b5af4881836d6337a
SHA1 b11dcad7c00c2c85354b131c796ae34bbbefdb38
SHA512 7fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738
SSDEEP 3072:/rFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirW+Y/43zNFk1C:/rFAoOXcHfIfiA+/
TLSH
T100142A14A7FD1B25F2FB4F79EDF6A0018A36FA262D23D71D15A0015E1876B40CA62B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a8.rbf

Path C:\Config.Msi\e59f2a8.rbf
Size 27KB
SHA256 db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57
MD5 aa8ef0154efa83de1c2786ab1cb76f37
SHA1 5e4fcdf55c34538dfdda172a985731019f74898f
SHA512 17d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd
SSDEEP 384:eZPbNawkFSvPSN4J3DztyJbDr3Zcv+qLrVAtJCl9F1WijgW1Qim0GftpBjF9ZE:eHaVFSvPSNEtyJvrpcB9qi/bfVizTE
TLSH
T170D21A00C7FC536BE9A70A717DE59981493BFF52AD23E21F4068C05E14E9BF48A66723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2a9.rbf

Path C:\Config.Msi\e59f2a9.rbf
Size 15KB
SHA256 1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099
MD5 62faa6fe395c5810fe4fceffcba62966
SHA1 ed830d3d1156c3a5ea6502148f4347af0c4a8051
SHA512 4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54
SSDEEP 384:21LtwmrH+mFqmwW/zwWUQim0GftpBj6XY:21lFpGfViWY
TLSH
T1D572F905D3EF8EA3DC825D319DF187827A3CE7834D62DB2B4159D16A2C633E8C961B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2aa.rbf

Path C:\Config.Msi\e59f2aa.rbf
Size 90KB
SHA256 ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9
MD5 facce237d5cc5e89d8e92a36289f588b
SHA1 5b91fe97781b107df2754a5d38807a597f1d99a2
SHA512 f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0
SSDEEP 768:F+nOfOpzCJztUjm2ElyGv/NIvS1SHhodPxAoiStZp4uXhblMB/e8CKMduoUZKP4d:yy+zGztUjm2oNIv5oiIZZz8C2D4RRVZO
TLSH
T15993F626E23684BDDCC9003C75983531A73CF3B78256A78719097DAA4DD3B8BC987B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2ab.rbf

Path C:\Config.Msi\e59f2ab.rbf
Size 168KB
SHA256 1246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879
MD5 d2d2a9e08ad2df5d73ca0aa0797cd96a
SHA1 f6050bc38d27c805daa078383506b93c5dd854c7
SHA512 197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de
SSDEEP 3072:fWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vam7xBAZiruL2b:fnMr8CSQ09ap6Jy65Rm2vp
TLSH
T1CCF309C1AB0BE061DC89563C38AA7F056F3CFBD295D2AB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2ac.rbf

Path C:\Config.Msi\e59f2ac.rbf
Size 55KB
SHA256 89885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55
MD5 158f96bd130a9f3a1f7e91dc611e8b7d
SHA1 207264f61e8d8cd77c7dd82e7c8c38927bcdef85
SHA512 6ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a
SSDEEP 768:+RXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24hbxocNAwkEGjhl2BOBaBnD/sxFsNTl:ZSk2HQq9D2bPeVqv
TLSH
T19043A342D21A96D6CC55A5342A70FB52E63EF3FB1BE1B65F8813CCF408A3250E945F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2ad.rbf

Path C:\Config.Msi\e59f2ad.rbf
Size 139KB
SHA256 38f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5
MD5 32f2ac5f45b93b733cab1865affd588d
SHA1 5062e6d2a8c1e06e19c9f0b29164915286ece618
SHA512 8384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1
SSDEEP 3072:DrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO++rCo9D5:DrwBZWkge7Dur/n
TLSH
T1FDD33A91EA35C259CE84C47D3E21BB00DB3CF3D644C2AB9F4526FCE84A8B791C552E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2ae.rbf

Path C:\Config.Msi\e59f2ae.rbf
Size 351KB
SHA256 55758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e
MD5 18a9dd94b5112ea94f3fc9fc22ff8409
SHA1 97a0b82343ef1599e517946a2c3c259b61e53ca7
SHA512 7bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6
SSDEEP 6144:ENeM8oM6s8alZ+afj5OADOQ4pUE9wstZY:49QZ3j5JOQ4pUE9wst6
TLSH
T10274A415A3FE5761E2F30B34ACB40489DAB6FD479E6A974F2445A15E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2af.rbf

Path C:\Config.Msi\e59f2af.rbf
Size 456KB
SHA256 a5a600ca8a60a0af629047ef8b227feba5221c5697f820da69e274f40869a6cc
MD5 54c12705dc6a32282762bbc4252e2b9b
SHA1 2d1fd38b5f3db7c7f0d7baee446a00099a506d50
SHA512 c4d96a8d8064ef917ddb98532360a8bf318535b310f908a384c0ca140ed058f5f3f24f34c3992da4399386f546381cbb1eef5432b3ff2b7c19e0491dec8d4aaf
SSDEEP 6144:I6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNic8iV:I6jwRSvQh42RNjN6YV
TLSH
T124A42B12C279D33EC2AE833754A226155BA5B2EFBAF1EF53A013C5E82C537C09D41A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2b0.rbf

Path C:\Config.Msi\e59f2b0.rbf
Size 137KB
SHA256 7acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83
MD5 9f735917c0bba0f42b40e719047eefd5
SHA1 d8c1ef036b9d841db86ffc76d9150064ee836cce
SHA512 65522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e
SSDEEP 1536:I2jLPfRUqxc0O/t4DErSu9e7EMaggaqRgDPRpTCWFVmI:I2fPJUqxy14DEF9e7D3gaqRKPDrfmI
TLSH
T120D30A00A3AA0B92D06155351FF2B942E63DFBA76AD5E75F5421CED80CB3B90CC22B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2b1.rbf

Path C:\Config.Msi\e59f2b1.rbf
Size 334KB
SHA256 7150db5b3af392a250b79f1078c87848a08b6c13448943d5a0478c2d37645b85
MD5 4b15c6de8b0cbeb6d4d7d6e14b9ca7fa
SHA1 af3b589712be828302778a6e248ebd659fcdabfe
SHA512 1f68f55cb4c32d0abf929b3382d9b773369f376853912829299c6386648c39807c6242eba037bb3988ebecd0e8b7197c91583243154c569bef1f70d0d958c491
SSDEEP 3072:700ASicZpLom0Wy0iwsC+KHIVKbHWuFvUOLKZXXZF6jJfIMRFxtZYg7eyXgMly3C:jlRAWy0iDCyVMvUYKZ+JICHNyPOB9Y81
TLSH
T193741B154268C32BD5E8C235BDB136124BBDF293BEF39B2B612695A81CC37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2b2.rbf

Path C:\Config.Msi\e59f2b2.rbf
Size 75KB
SHA256 b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929
MD5 683fc126a13b915b3ff36735ea5ca5fc
SHA1 d1ccfdf78919f51b09fbde02c2cf0f332601bd74
SHA512 4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9
SSDEEP 1536:3skby0ayhkM+TeVCB5+G9cTvdQc1bqMsDvbmOpajgNiNYV64:3DbyihcwqHpa8N4864
TLSH
T1E073F718D7FA4FB3C2AA4378ACF1424256B5F402AB52CB6B18855F841D73B94CD13B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2b3.rbf

Path C:\Config.Msi\e59f2b3.rbf
Size 389KB
SHA256 878566ee8a41806ee9b9c4cf590e1953881dde2127616a647fa31940a5096cc5
MD5 1a063e60707636e76e61ad9784bb1eea
SHA1 baf498bac402a29b1330fcd20cfbacbc5d245cf7
SHA512 39e2bcd04f4ee4e6280b7723a628acfbceef254fbea62833a34d7f4cba566c9556bfcfe2424ada027112a8b722da8349331ca416d00d0e3d6afbec96e3d91a65
SSDEEP 3072:2dxlMI0R4F60aGf0TX1zvAPuiFvVTLqtdte2Seh6mNfkGVq1XRQq7q9kAaKrVm29:nFva9GVq1XpAa+TcGR
TLSH
T1EC84F72073F94218E9B70B31ECB651C51B76BE67BE14CA2F2449315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2b4.rbf

Path C:\Config.Msi\e59f2b4.rbf
Size 131KB
SHA256 a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a
MD5 d8a76dfe6188e600bd7a8480dcedcbdb
SHA1 40080e226be118c2a0a8f9dd70879467ec09f198
SHA512 9a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76
SSDEEP 1536:6fg4S0dRp1s8PW/OvAza4KFvQFa8xVsbtglOJzgP2wNmqgEEFBt9Aak/pKohxm3X:0N1zvAuFvVyV2sUz8mqc9AakhNhxm3Ss
TLSH
T1D0D3C41B93FC0269F2B70B71EDBE45CA5877BD566C21D25F044A368E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2d3.rbs

Path C:\Config.Msi\e59f2d3.rbs
Size 730KB
SHA256 0490cb4e526ebaa901dfa7f05846e7ed2b99651c156d634e099bcb0f615595c0
MD5 9cf0fbf6d725302408181c8943a1b534
SHA1 0d3b2d32d93459f25e6d823ad0fc2ba4970f06c6
SHA512 e57a2db432abb343d5c62f32db47367782ea51b997764c59096cf8f0c4a6d06c6893853febc88c0c458fc6b5d6734e77faf96c728adcca54864d2be76d4d20b3
SSDEEP 6144:Wo6drDjORLIKuRy6QK9/NMR389050RGEkGqv3DQkgRMP7SCIS27RI88/HnZrGpaw:dAyluAN89BycS5IEZysh7e
TLSH
T163F47342B14092D2D0DA1BB0C5A73F197F2BF6AA4AC2971F401CC1784C97BDDAD5EE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2d8.rbs

Path C:\Config.Msi\e59f2d8.rbs
Size 48KB
SHA256 2f63822582c7f7074feba5ec29a2d00225337335661a69486075aca302079b1c
MD5 1cc24b0b1ca5fcc83dd81a3e88095261
SHA1 dd6da2a91d8ffddbef7ff168b6d657c1df820b44
SHA512 8e3e6c8fec4f19fdfca408ccf09cfce5c6ed68abf1adb47eae798ebd4a82ef399849201603b6252f9a085556a02387ed2178f3b7e0a31aae4fcd00ca4512d511
SSDEEP 1536:voFVHvMRzGFqt5uIRx5HKjKRrhSp6qf9nEtkP5CqTBDE8COmwBzaDW3qgbom5qx7:eG25+RP
TLSH
T1A1231450AB19C0DAE2B2BF503332EB0427349F965B89895D3AD542D4DF8DD8E4FBC0A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2dd.rbs

Path C:\Config.Msi\e59f2dd.rbs
Size 9KB
SHA256 349df16365390dcec6f2c02305e0e9b9f3d6da11c929023d379f5141b473e765
MD5 ef23b7f335f42c83b7205ec5db4e136a
SHA1 f6c3db71ddef88367f8299f553acf2b944bac5ef
SHA512 f62587fbb58776321dfba26af76c1ce94999e666507da471ea0a9778a15fc220f3c680305608550a1494f5820f3fa6f881d229a537deae0dbd168f4dacf68747
SSDEEP 192:1O2cgkoIbhZCvZZO6ZEI5LZO6ZEQm58E2gU/Veppaxk:1YAzpzh/e
TLSH
T126121042660186F2E9561B34C7832B263BB3E38AEA0123971CCD91648E5778E5BE53D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VisualCppRedist_AIO_x86_x64.exe

Path C:\Program Files\GameSir\GameHubManager\Addons\_Redist\VisualCppRedist_AIO_x86_x64.exe
Size 27.6MB
SHA256 bfc56a0e6aa6fcaa013fc9bbd0a39f060e8e7ca84e5e16c1b62a99e94d4cc26c
MD5 0ed3efb716d505769ed181e19c5fe9f5
SHA1 6499c8109339ae028ab50b347f976ee283abe413
SHA512 48a6f84bd767ba193a0d41ca0a30d5dc1a9238d574e60526e52cfa79b9e0786c1f4a7685ffe68b0dbe1eadfe83d3d9973d8ceb5f9fb27dcdbd93aa7562fbbcba
SSDEEP 786432:cCzv71vHpA8632XRXGGhbFTJEvPCFqeGM+1lI3MC/HPo:vtpA8632XEGhbFTJ4CFiMX3MC/HPo
TLSH
T13F57330321EEFDE2D83660303B73D7D8FBBDED86A524C59A2DE1190562BD6233695390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\GameSir\GameHubManager\Uninstall.exe
Size 223KB
SHA256 cb56e776fb68bc9d7b095a7f734c90c609a08d90ad7c7db157898f90454b178e
MD5 e52735a565c080a1d1aac516f7aac7ce
SHA1 d2953a601e647bfa1c18ec09a5207b0f8b8f4410
SHA512 02f8c9b236fb30cec233a96b32c02d8e112e3ce634c0a7dd0c52f1ed9297ce451fd429ea63aa23a111143ee3be9722216c4230a90b0de95e8bd3110f0e4e4b5e
SSDEEP 3072:QXv9qKohEb1gudYqs6a4IdcIo64NmooAZLnTX91lArb/lyvyXpHmdkAkYRVib4qx:QXsKoGxWhLXsrvVvbix
TLSH
T15A243BE2D6CA8CFCE5524B388A77DD5A217BFD24A935491F152AB8799F331C31836803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XiaoJi.GameHubManager.exe

Path C:\Program Files\GameSir\GameHubManager\XiaoJi.GameHubManager.exe
Size 10.4MB
SHA256 3ae4a5269a45f06c121703dd9d5817fb8e7c2fdd974b3823502f8d46ca13219b
MD5 907b7978f9e507c8d641ddb279050547
SHA1 11741b1bf63b6155fd71dddfe3a431d864cf6d50
SHA512 5e2af9eae6e7c63ce7b6f9cf454d57443b589321b3a4946f2d51c06bfe9a584dcc49cf1140b0735121e6d7216da3390c0aa8befc54c80b809b5fc584f014ed89
SSDEEP 98304:GnGZsPED1LOXuIORcqpzof7qcHkR+L11p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhQ:GnGZ8EDEZ0s7qcERa1HZNkq4pK
TLSH
T1B8B617196FF84B26C3A74679BCA0B3F11B255D171101A7460AC9FA1D7C762F08EA12FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XiaoJi.GameTransferTool.exe

Path C:\Program Files\GameSir\GameHubManager\XiaoJi.GameTransferTool.exe
Size 13.2MB
SHA256 529b3787cfd2e0a49a83785126cf2d3bc971b18a89ac524f08bc7d770f7c1e02
MD5 3bfb317996de28b323703ea346754e66
SHA1 a49b7323243965c0cdb03168c42db664e464e713
SHA512 9a75367f5623cc1981ff6875c2a047834c4aadffc649aaf8d135f268e37f07bf8691babd03341c4f6db9e2f9de24df2075a6992b9a6399203b88301c79225945
SSDEEP 196608:lnGZ8EDEZFzXcOwTE0ks4X9gz6uea7EcERa1HZNkq4pJ:4TXQ9gghcH1HYq4pJ
TLSH
T1D8E649192FF84B26C3A74679BCA0B3F11B755D171101A7460AC9FA1D7C762B08EA12FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appsettings.json

Path C:\Program Files\GameSir\GameHubManager\appsettings.json
Size 462B
SHA256 816c1d4325f06353bf799fcfddbd3b0542b2c9600f63da21f8d2e79422c50155
MD5 828c48fe5e03e3510713df92037e9fd3
SHA1 d6e75e067fd223cf24cf108dd24e6bd3f8f7e080
SHA512 8cf2656f96a44fdb4527784bf32c3250a41f3a9db24aa7e9e9de59698d375d73d87e33042006b50f7c1e514e704e8b66d999040c8d78fa1f366d1d42dee83604
TLSH
T1F9F07D37CA0D0E571A793B719B644302FA24437F0A51500FB4BC391E0F7A4101B80E6C
MD5 SHA1 SHA512 TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
Size 232KB
SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
MD5 824f1f188704d3de77660d90fea6b136
SHA1 9bcad1428defece9f2ceaf647d9571ca41b3f40e
SHA512 0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972
SSDEEP 3072:55Sa1UNmUq59Zh3pe8lwAx9JHHpXhvq5J38J:55Sa2qr/HHpxva
TLSH
T1E7344C11B552C133D8853332406FDFA12AAC6EE79B52C58721E932DC6EB17D4D3792CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARP.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ARP.cmd
Size 4KB
SHA256 f150278a90b592975b396cbbc349a8ec0d25b114190a6c461bacfb655d7f1e08
MD5 19c93272e1733002dfda9f75a7a3e372
SHA1 babca57a07ba2eeacc4adf7991db80bcf2f0e2f5
SHA512 87fb886161ee1b792f3e1ab25fddbdc9cbfe7aae13f6dc5b8e733611c1b12d0277d9ab067603321f2cce2aff9d2f0f8318b1e5935d50c346f0fb66cbcbb6f9cb
SSDEEP 96:MINtocXksyNYruafMiYYGjTWwe9RKPDPEPhP/OHk+yAJ9uOuX+v9Sq0FU:1UsLXzJXwe9rOvZuOXvmFU
TLSH
T1779130307E18D02041F4D2B1E225CB43F7ADCAAB5BA6F3C839E3D4A1A49A255D63C7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 26KB
SHA256 002a3f0d1b2a6c07314a30366950ca5b7670e20b26ae4e72451a5a99b6d37871
MD5 7d8041ac84c2637265e5163a7e53cb11
SHA1 fee764b1cdb195f95ba544b0639c4accf7190d3a
SHA512 e7e1c16b42035751fb103d2f6e26c388fb9862cb5d3815d5e32e786bbdfd4effc6dd0a10af70a51366e8c6dd7d530e1a5ac57ad1eb937cb0d0edad2798e40d08
SSDEEP 768:UaSz7zzGs+PFJE7yw1oon3RAL9iAbO0igwJz3/o9L/Y7xoXyEMdBE2SEAgEEc1Pr:pL9ix0igwJz3/o9L/Y7xoXyEMdBE2SEQ
TLSH
T174C291187D4C52367AF0C3B6E3359182FB6ED5A25B30E68C7CE6C8A0746B156903E3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 9165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c
MD5 ed14b64c94f543974b7fdc592fa0594b
SHA1 dc66ca3de44c021d89ebd5160c447aaedc565514
SHA512 5d20bedcfb8d2f603b3f27d874a9e0e3a7ca7df4809aab52b02af630c0037b37923536cc93c78c9deb014df28e378d16d67e99688f8b656e3e7bfd1e2e914dcc
SSDEEP 192:EFW+NhW76T71ojDBQABJdZqnajxcRGlP6ZqDPD:EFW+NhW77DBRJdZll7P6gzD
TLSH
T1AA42098357EC5903E5976E30A3F9EAC3BE3917C629202465455AF5A93CC73DAEF0062C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 4aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449
MD5 1908861649e67cdc20c563c234a89914
SHA1 471ae3b9a3b40e63c880362892865ecf8bd80f67
SHA512 dec24d5c3f31c90cbec3810290506309a1db5677022c600d3bdd2e92b73078dc6353023f2aeefa408aceac7c9f7ed5a2ff07a399b446e177ff93e5fa1b3f9353
SSDEEP 192:alUcyiW+NhWZT71ojDBQABJctYDqnajsl/cKfX:oDyiW+NhWCDBRJcyDlPKf
TLSH
T12062D64366E43F26E99F177221FED7D72A38574214A003B4C207E58C3882796BDA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 6a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda
MD5 af851dfd0d9fecb76ff2b403f3c30f5b
SHA1 30f79fb4d4c91af847963c46882d095d1f42efbe
SHA512 04509b02115ec9b5bc4ee2f90e49e799ccf85884fe1f11f762f0614a96764b8f2b08f96895c467c5b11f20273183096b2bcceb0b769df9d65b56c378cb32b0f5
SSDEEP 192:+SW+NhWHT71ojDBQABJ/YkXqnajL1dHx3tKPDGbO:1W+NhWUDBRJ/YElXBtgEO
TLSH
T170422AC24BB85143E99B6D7052B8EB877E3CA7D66810012619AAF5993CC73C5EF11B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 2def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a
MD5 0f143310fade4de116070a3917a79c18
SHA1 b9a092e885c73cb6d33c9e17d429ede950cf3a26
SHA512 f87104272aa2326641e46450a0333626567ab3fa85a89b81f7a7c0b1f90a47a70ea189ce3f6bf5db6bb5cccda6d190fb2276edeb44334245b210e7faca05fc60
SSDEEP 192:1M81nWlC0i5C84W+NhWCT71ojDBQABJibqnajMHxxBNT067L:1M81nWm5CfW+NhWzDBRJalI667L
TLSH
T16352198747E42D12EAA71F7221FCEBD73F3E6B8108524666801BE19839C63C17F1595E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6
MD5 f97e7878a2b372291b1269d80327bbf6
SHA1 cee6f776fe0aa5a6d4854058f20f675253f48998
SHA512 475898e60ffc291362fda45ab710b9ddaf1cf5e82f66dfcc04998ded583c54692ecfcac6cc4fe21b32bdd0e4dce8ac32fd9aecca2b0b60f129415180350d7825
SSDEEP 192:lCY17aFBRgBW+NhWlT71ojDBQABJh+qnajMHxxBNT0677B:VPBW+NhW+DBRJh+lI667F
TLSH
T1524219C68ABC5943D9A36F7072E8EA8B3E3E67D128208557415BF19A3D433C1AF1062D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3
MD5 761ddd8669a661d57d9cf9c335949c06
SHA1 251bbcad15771d80492f1deb001491a7abb6c563
SHA512 5ad590a5f81532f8bf21fb4f62bc248e71bbf657dfb1720b2d9f1628033afe39426a1c27a89d9a06e50849bd0ed2242afa93e4cf2bc83f03a922b8204f0f4f2a
SSDEEP 192:1T9qW+NhWQxT71ojDBQABJbcFqnajLQvTP+8jgiG2W:1T9qW+NhWQqDBRJbQlvQyUgiG2W
TLSH
T1FD421A864AE81443E5926EB046F8FB877D3E77C2182548660557F9A93C833DDAF40B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-math-l1-1-0.dll
Size 20KB
SHA256 2e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1
MD5 56556659c691dd043dbe24b0a195d64c
SHA1 117b9a201d1e8bb9e5fadeae808141d3fa41fb60
SHA512 a8d4c4a24e126c62b387120bae0edd5cbce6d33b026590ff7470d72eb171ffe62b8b2b01e745079c9a06cf1eb78a166707514715e17bbd512981792a1d2127e0
SSDEEP 384:WZVacWM4Oe59Ckb1hgmLEW+NhWvDBRJTell7P6g2:WZVJWMq59Bb1j0NS1Pae
TLSH
T1AC92D5474AD8FF67C18F17B711F08BCE6A381AA644E1B6B5C91BA0C934623C47E43A5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 c136e09decf068b5f33041753c6fe9d4af7429e00bdbd8d2cb8d2a4d503e755a
MD5 e9f6d776545843a9817d8acf38d06d09
SHA1 5277698e6c9c4fd3e16757d86e1669a5fc64a6f4
SHA512 d12ee6b7afe2823632602b48d257d702552e9b644d62c0d0ccbad9f298ad9e044266baa1cbffb656075d6b5317883bd1fa3b5c29fe25e132ed61c230d3007a4a
SSDEEP 384:1vF7vLPmIHJI6/CpG3t2G3t4odXLNW+NhWnDBRJJlI667K:1d/PmIHJI6zNW1Ps66O
TLSH
T107922E6F4EA82E11D58FD7F3B5F6C7C62A351F8004C073B5A66B95883805EE9BD42E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-private-l1-1-0.dll
Size 62KB
SHA256 892e89afe2c43dd5b274abe461cb650932e8cf8ded640bc7e8e2456d08800a59
MD5 653cb5df3cec6a4a0e402b33d8aa5c08
SHA1 feb8baf43eaabbaeea4291c5620cd7626aa76fe0
SHA512 e3e673ff7b20ff7389be3299722af73a79ef8ced4a59d6b8948c6b11374703fcae16818af64338e413db3fd53d25d1d153f2d987bef6135a365481aed0c3c228
SSDEEP 1536:DW2wDe5c4bFR2JyhcvxXWpD7d3334BkZn+P+NoPKu:DW2wDe5c4bFR2JyhcvxXWpD7d3334Bka
TLSH
T1B553E5DB49E63F21E18FF7B76BFB17C91B253A0408806274EAC7556B34853A9BC43A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 52cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649
MD5 6631c212f79350458589a5281374b38b
SHA1 88be6865aac123ffbdafec32a6fba34a26428875
SHA512 e53d7bfa2639efccdb66d37957972fd1f8eb2beea3a81145588ed622501ee50261e05a06611ee7126564b11a5301b109f295d062f1a2dc1e44a2847000fd7298
SSDEEP 192:1/aitIqjd7cW+NhWfT71ojDBQABJoeONqnajsl/cKfX:1SitIBW+NhWcDBRJSlPKP
TLSH
T1A342F8C78BB81957E6675E3041F8D7877F3B93C658108135886BF19E3D82396AF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 8150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f
MD5 bbae7b5436d6d1b0fc967ff67e35415f
SHA1 f67bc165cefb119ad767b6bec27a1102c0fd2bac
SHA512 4201a8edfe303057545d04de683bbdf0acb68cf4d2e894192f899a70398df18299432c0f6caee72d917a986882bbc0585035a9b934d4579f67a1c98cc894dee2
SSDEEP 192:erMUnaPrpJhhf4AN5/KiaW+NhWRT71ojDBQABJ6qnaj9RlaHIxX:N42r7oW+NhWKDBRJ6lBR4HIx
TLSH
T10C72F98756FC3F63E9872F3322F9D7C71A366382152045798897E0C93882385FE5721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f
MD5 53e9526af1fdce39f799bfe9217397a8
SHA1 f4a7fbd2d9384873f708f1eeaeb041a3fbe2c144
SHA512 8167ee463506fe0e9d145cc4e0dc8a86f1837ae87bc9efe61632fb39ef996303e2f2a889b6b02ff4a201faf73f3e76e52b1b9af0263c6fcfdac9e6ea32b0859f
SSDEEP 192:1/rjrvIDmMSNuWYFxEpahysW+NhW8T71ojDBQABJ+qnaj9RlaHD:1j3vAmiFVhpW+NhWRDBRJ+lBR4HD
TLSH
T18882D68785EC3F02E28B8B732AFAFBDB1735438224107579C507E4943ACA3997E07559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333
MD5 eccf5973b80d771a79643732017cea9a
SHA1 e7a28aa17e81965ca2d43f906ed5ab51ac34ee7c
SHA512 b95f5efc083716cb9daba160b8fa7b94f80d93ab5de65a9fb0356c7fb32c0d45fe8d5d551e625a4d6d8e96b314bae2d38df58b457b6ced17a95d11f6f2f5370e
SSDEEP 384:jsx0C5yguNvZ5VQgx3SbwA7yMVIkFGlrW+NhWqDBRJD1HlI6674:m5yguNvZ5VQgx3SbwA71IkFKN71Pc66s
TLSH
T13382B34346F83F51CA8F5BB359FADBC72A384F5225401375C467A5CC38427A2BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e
MD5 090dd0bb2bddee3eaae5b6ff15fae209
SHA1 ddc5ac01227970a4925a08f29ba65eb10344edb1
SHA512 2e0b8567231e320b2e52af3b86047cfab16824e2db1d1bb17bafe7a1c6c5f0bf62d76656206a3d7ef1d3849b479bf5e09db1f0f4e4cd0aa2df09838d35c877f3
SSDEEP 192:VuO/z7kzFDqpW+NhWTLT71ojDBQABJNqnajxcRGlP6Zq14:VPEzgW+NhWTYDBRJNll7P6gC
TLSH
T1C75218838AD4BA07E9EB1B7112FDD7DB7B3813C11A9020768257D4983683385FF16A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_b14b23e4fd2a22dd\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 e7ef5d714fc21dd1aa9db0c4eefe634463eefbd5aa4454a568bfc52e04fddf18
MD5 cc337898e64d9078cb697ac19f995c7f
SHA1 2ebcfa0cdf865fe40cbaf4ffce6d3903aea47e3c
SHA512 6960fa9617514ca223b9abda9a3a6c69cf05474b3c5fec2be6c6d5f65580c7a18e129b6d207f21eb136b0737481107e09c20b0398826284ce5f9a65a3cf8a1ca
SSDEEP 192:aBfHQduPW+NhWMT71ojDBQABJX+4qnaj9RlaH:aBfFW+NhWhDBRJX3lBR4H
TLSH
T126422AC60AA86943E69B2F7063E8E7837E3DA7C214308625056BF1993C477D2FF1162D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
Size 971KB
SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
MD5 1eb17f650462eea820f4cd727d2d3ab1
SHA1 688f59160589ffa293502bffcd5c0e62e1993903
SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
TLSH
T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-conio-l1-1-0.dll
Size 12KB
SHA256 5b679b8119bb5d53107c40c63df667baef62de75418c3e6b540fdbafcceddca6
MD5 8e534f49c77d787db69babff931a497a
SHA1 709380f53f4bee25ad110869ac4e755391346405
SHA512 49e293828c96f159e2311b231e13d7292b9397aa62586bd0289c713e541d9014d347cde07c8529df3402c40e8fe8a96ab72efcce9f731ba95eb416506efcdcea
SSDEEP 192:Ej8DW+NhW1T71ojDBQABJbyqnajLQvTP+8jginyR:Ej8W+NhWODBRJbylvQyUginy
TLSH
T18242098356EC5943D5535F30A3F8EBC3BE39278628605466445AF5A938C27EAEF00B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-convert-l1-1-0.dll
Size 15KB
SHA256 9ce840d9a67c4700d271f27a8e5163eda506ce46c85b501687955b55fcb3d136
MD5 33e8ccbe05123c8146cd16293b688417
SHA1 d73246eb64af4f7ded63fb458c6e09c7d500f542
SHA512 5468adb8e76aced26f1f33fd0cdc72d194f92b1cbdf3f8169bc12e0eec1593f568c18d0e937898ccc3463003f939181131e41c6d5928bf393ded09c95f63e705
SSDEEP 192:cpdkKBcytW+NhW3T71ojDBQABJbkKXqnajL1dHx3tKPDGq:wuytW+NhWEDBRJbflXBtgr
TLSH
T14462E98366E43F66E99F27B121FED7D72A391781159003B1C207E59C3882782BDA7D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-environment-l1-1-0.dll
Size 11KB
SHA256 69e2e6459ea24237d5fcfc429acbc80bbb5852044a1b79f0aa6b544c4f770d95
MD5 85ceba9a21ce5d51b35ef2de9ebfbac4
SHA1 2d695a3e2257916f252d746c5cc0b48ac2ba1380
SHA512 5d2d7e9079f53efa667f29529ce9c9c10af8d7ef541b62e2934c6b68a0a16cbfec57e49297091a99c9db3bd0674f3173036e018f6559be5d6bac554d1da8f29a
SSDEEP 192:FW+NhWhT71ojDBQABJeWqnajLQvTP+8jgiM9:FW+NhWaDBRJeWlvQyUgiM9
TLSH
T1774219C64BB85483F9936E7042B8FA877D3D67861820452A056BF59D3C873D6EF01B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-filesystem-l1-1-0.dll
Size 13KB
SHA256 8b018f12e560d1179f1ad72811dbf7c60743061bedfa332a6562cf3db5cb413f
MD5 73ced8b30963e54d262dae2559116e46
SHA1 090e42c4b7f736e69c248ad6b790bb68b5bee9ee
SHA512 b7c0514c14ff82efbdc69ad42a3fef0a9aa1ba5112e98f7911cc6abec238980ac1104d467278608fea65f5674b6097cdccf17698c076ee14cc5d963819877ec3
SSDEEP 192:+7q6nWlC0i5C1W+NhWDT71ojDBQABJA0drXqnajL1dHx3tKPDGY:4q6nWm5C1W+NhWADBRJA0hlXBtg9
TLSH
T11252098357E83E53DAAB2B7152FDEBDB3B3D17C1055242228017E1A839C63817F12A69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-heap-l1-1-0.dll
Size 12KB
SHA256 bac9384ba44857279ac04865686941243ea4fac9c08c3d29feb1b53d92e76edf
MD5 4669249fb01ea369c7fd40a530966fa1
SHA1 106454588625bcf1a86db25333bb519e7f09ee61
SHA512 2036043c318d164d6701c022c7bb7569051a8fe8e87518a62fc4259fcabee3da481197a375c607ee1505ff66467dc019e1fb4a9db0087c3b0e064c1d4ef864c2
SSDEEP 192:zY17aFBRQW+NhWWT71ojDBQABJBlC+XZqnajxcRGlP6Zqgz:qNW+NhWXDBRJPPJll7P6gm
TLSH
T147420A838BAC6443E5A37F7066E8EA8B3E3E53C56D204857455BF5E928423C5AF10B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-locale-l1-1-0.dll
Size 11KB
SHA256 3927a4b0b4591989f8c7b25e747286b359618b4de6f7680b2230c1cfb0d12782
MD5 b23936cf83dac4b64660a88711b5234a
SHA1 61431cfb47f8d36e67d2a046db318015af4d3107
SHA512 f9c4cdda309b64a51cc4ddf0d033d2c20ec11a92b8cf46c190d1f341434f28bf683960e5ad7d06ba20776bb95f5d9725155864efe20fcb2775cf4ed2d1568b41
SSDEEP 192:VW+NhWhT71ojDBQABJKrqRgqnajxcRGlP6ZqhV:VW+NhWaDBRJq+gll7P6gD
TLSH
T18E422A868BA85043E5D77DB059F8E7877D3E23C60811481A119BF9E93C833DDAB04B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-math-l1-1-0.dll
Size 21KB
SHA256 a2dbfc1a5baa66e257a4acc63289fa73adba893f837e2b304097ab829bab257a
MD5 c1096da4634ad3356a10c00b24f53393
SHA1 6ea87bf1a88e57954f1c34047423bc342cd407ca
SHA512 d0ed94cb0b7746c324067d9485620d8693140c04c110482d685560e21c730e840056c87dadf58239f6a9f3e28cd650b0b8ecac011e03b6d6b57adc76213f0427
SSDEEP 384:kt47isbM4Oe5grykfIgTmLSW+NhWXDBRJE6ll7P6gY:kC1Mq5grxfInCNu1PEKg
TLSH
T1BAA2838789E8BF67D5CF0BB701F4CBCE66341BA154E1B5B4D887A1C834927847E4B948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-multibyte-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-multibyte-l1-1-0.dll
Size 19KB
SHA256 bf1292e2b4808884ef85fb40e75644c813063e34511c01706ebde9f4b5368c3e
MD5 cbf3cfc9ee1fd29707d95c63a5e7a78b
SHA1 aa91416f203466f24c0685c71a287950851d3d6b
SHA512 aafa2e8d89b3d507de47df3e908439f4d2130eb56fbd78fdf9bf9e046cb46bf7b8b93c1d6e0b5c83ea06615b78ca36b919628ed20919fc6ce373ff8c11a53b3c
SSDEEP 384:Wy+Kr6aLPmIHJI6/CpG3t2G3t4odXLxW+NhWpDBRJVell7P6gO:WZKrZPmIHJI67N81PV2G
TLSH
T18F922E6B8EA82E11D18FD7F3B5F2D7C63A350F8104C07375A66B95883845EE9BD42E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-private-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-private-l1-1-0.dll
Size 64KB
SHA256 1caa06ba419a05129a54e085aa80aa8bbe533c7276574036f75627c421cc436d
MD5 94feb4417cf3e39c8c58a1b73620687e
SHA1 ea03ac74ff1f49f93445781c90d5518f5e5d9cab
SHA512 ef1fe9201b915fb5d551c09b59846408c3ed27e5a6e832f732a521808970526a16e926b9585051d7705f363aa021ac4f087ac508c7cdf5130eb8ead77dd867d5
SSDEEP 1536:Ft2b2De5c4bFX2Jy2cvxXWpD9d3334BkZnkP8NvPIz:Fw2De5c4bFX2Jy2cvxXWpD9d3334BkZ8
TLSH
T1D75319DB49E63F22E18FF7B76BFB17C90B253A0418806170E9C7566B34853A9BC53A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-process-l1-1-0.dll
Size 12KB
SHA256 58dcf9ec3d0747a4ec23c7a1ccdb8eb0a6ad3aaebb0d8c0dd480922d012c8ecd
MD5 00a0a24bb2e9aade11494b627eb164c4
SHA1 98c1121324f8e8aaa64c673d79315cc27fa0d25c
SHA512 c8574f04172aed489b8ee91e0189314ca6b66d0d8b99275968ec888ee5c13f5f7b6d211064620b62fa1bfb6b54d7fd832823cf582e7949a07d5ecc45275b4f79
SSDEEP 192:lRQqjd7tW+NhWdT71ojDBQABJ1P4qnajLQvTP+8jgiX0/U:lK8W+NhWmDBRJ1P4lvQyUgiX0/U
TLSH
T1EA4209C787F81997D6635F3041B8DB87BF3B57C2581095658917F18E38423D6AF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-runtime-l1-1-0.dll
Size 15KB
SHA256 096139cdeaa408c3e3bd393a7188cbd6c296c3fe4e4cc15da113286a3f713dbd
MD5 408019e57d3d2da62a9f28389eed0ac1
SHA1 e48d1166a8fb95da90787d820ae7cae859bc626a
SHA512 fc18b2b1aedd2611ce78e92c4b283f519b5b25ebb0be5fe618a4fdbdf60c68f1edb486b74e59990e04f6b2606a9681edd433a32e6f9dc10ffe043d8dcc64eb03
SSDEEP 192:A0CjfhrpIhhf4AN5/jijW+NhWIT71ojDBQABJ9XeoIpXqnajL1dHx3tKPDGRK/:Ab7hrK4W+NhW9DBRJj+lXBtg4a
TLSH
T18E72F7838BF83F67D58B2F7312F9D7CB1A3A5382255051769853E0D938C2386BD1721A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-stdio-l1-1-0.dll
Size 17KB
SHA256 51c54ebaec17c1216e0fcd926a2dc8a377cf278127e4fbf6cd26e0fda51c23e1
MD5 9d66fcc681389ec619d4e801f1ddbb2f
SHA1 605385439a2b9295efff604f27849778696befaf
SHA512 0776dbc733491502c84c4eb3d532b52acea0f08258647d488ffb68df2997ef4cd750b2667f94069991ac7c4001be681cd525e56af51bf1f43dda4f095f6daa00
SSDEEP 192:GFbNpuWYFxEpahjW+NhWqT71ojDBQABJa2syRqnajLQvTP+8jgia0:mUFVhjW+NhWrDBRJi6lvQyUgia0
TLSH
T1CA82D48785E83F42D2878B732AF9FBDB6B35538228147579C007E89835C9399BE0365D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-string-l1-1-0.dll
Size 17KB
SHA256 083b8b0e45864b12c60417dd3c5fe88b68ffc45a245d50df84f2a55b1dfcab38
MD5 6c7f782fdbf9aeffe7663fa1579a610e
SHA1 d1504bf86117cd552bc1b97a49745780d35007bc
SHA512 d293ed48b09a0ad5e6b3bd0ba45feac092fc4c06dcb06eb661b6df7a061e402148a31b45b2074be97b4bd6ee7daf92f60cc17e1bd4d655f4b1cbc0bf7b3c8974
SSDEEP 384:2iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGl/W+NhWlDBRJ2Dll7P6gMJT:26S5yguNvZ5VQgx3SbwA71IkFGN41PeM
TLSH
T1FD82C24346F83F52CACF57B359FAC7C32A384F4615402375D567A08C38827A6BE6BA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-time-l1-1-0.dll
Size 13KB
SHA256 7a69214583d61cca3b8d765b488d6da070fccdcc02b76ee4c66aeb809f88c1da
MD5 39f9d0f1b698d53d78c79576c7c60526
SHA1 a2015e56318b650de7436231db6a09ab95f001db
SHA512 262fd3231c73f35deaebcb5953ebe3a639d8e4461a58d546ee962f5f1e254cb40eaad235ed4c2da780b737158ba82bf7c029e35007183a7891bea307edd922b7
SSDEEP 192:famDSW+NhWpT71ojDBQABJFiRqnajLQvTP+8jgifbKg0:iTW+NhWSDBRJmlvQyUgifm
TLSH
T1BF52088346E46A07EAD71B7102FDEBDB7B3417C119D0617A8117E8983687385FE1392D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-u..lcrt-apifwd-winblue_31bf3856ad364e35_6.3.9600.18144_none_552c886144ccb1a7\api-ms-win-crt-utility-l1-1-0.dll
Size 11KB
SHA256 44d5822d611fe29cb8530fe4bb86eaa8f9f2e135504e2304f8ab4ad6e37b8d36
MD5 9f9fe5f52e9b2ad655c896b849883b1a
SHA1 fd1119dbd0c38e7fc075be6a9d0efe4789f78387
SHA512 7970b3ef135423602234737da54ba6b248b670a818616f501db6e64455c7a89fdc023ddd711c6a45a7cfc25a715fa8a9c608013bca2a724f5d605b95f32830d7
SSDEEP 192:zfHQduvW+NhWnUT71ojDBQABJlzXqnajL1dHx3tKPDG8o:zfJW+NhW5DBRJlblXBtgI
TLSH
T149420A834BB85943E6AB2FB093E8E7837D3D27C5152042620496F5E93887791FF2172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
Size 900KB
SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
MD5 3df1d7da8c1493a5a00c0474323fef20
SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
TLSH
T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Common.v9.0.dll
Size 361KB
SHA256 67d21938143f9368acf1c8c9e4cf3cc7d766cf430ae2314e633862e547e102e5
MD5 27d93e8af5f4cee915fc121075de8161
SHA1 84c40fbf2ccf8a614f45255b0fa6a1f0c9269105
SHA512 8f127be26bc002d05b5f5f3a1d509de9d83a52776d60c26df7e0c5e409a06b855845c0c36cf55c8ccb83323adc3b1e601fe701b88ce55b79e112f298aa5fb110
SSDEEP 3072:NAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Es:NAikDFsY3IYU+uojT/xK6ur6EaPef5Y
TLSH
T10D74C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610A1871BC19A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Excel.v9.0.dll
Size 437KB
SHA256 b2171260fb1e9cc28dc640f730f5a21b8538af27d0246716a19c1f1af79e23ad
MD5 a6fb2c5f09c4ee2b5256c3a58fb2b4d4
SHA1 839136ccb8a70903eb103825fb8a21b02cf397ea
SHA512 20697cdbc007dfa8e672d35d7689c068a82a6ccb3dd19b360f23c05f3a30c2e7273721d85045b1ff596d03553f7bef7de7733fbf7dfdc48b8ec4d23a4e1c1ff1
SSDEEP 6144:DNu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJm:Ru/UT4HQ+hpxK1/ewG
TLSH
T19D94F71023A88A2ACECB0271E55BC6158674DB0A76ADEF5F5DF5F2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Outlook.v9.0.dll
Size 85KB
SHA256 d43340f4c89b7ecf80004bfdeffcedbb94b6e218f2f9804643bbfa08bd8131b6
MD5 af009a95b5876c2ad8e1059151889bcb
SHA1 181370b3ef2fc8240eb01c441fb022d76ffbc650
SHA512 d4147b7711375441e6a393e9ba18191dd3caf5a1de6472ecd891ace8a11ced123cf615338533cfa6bd27a9fa9e92de3fdeb46c6e7155f2ecab9e33602eb260ad
SSDEEP 1536:HI/320UJsbta0qhRwfLyCzj8yAGjyBermVzpv:HI/3VTqhRqLR8yAtBPdv
TLSH
T103831700BBBC4796D5FA0B79A9B990119875FF967802CA2E0E94B14E14F3F90CA71377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.Word.v9.0.dll
Size 301KB
SHA256 978413ad8b26182656086e7271cfc30cd201abc2141c76cf2fc1eb3c472e7f4a
MD5 6b4df7cc46e556f0605529ef5f2388b4
SHA1 78d27476b9632cfe4758cdf72657ee9c308590cc
SHA512 94ae8fd6750e00d56a36373e4f5434ee03dd9840315a8bf92047316a220d5a0f234af3ebd39747c0e335dba862a05dd77e91be21f86f6dfee548465b9d1b9363
SSDEEP 6144:f/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfd:f/3++m0QBrwOMPL8R60SxaS7Qa9Cngv0
TLSH
T18C640806277C4A2FDA6B0674F5B2067116B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
Size 101KB
SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
MD5 ce18bc86e63f3192719ce0d7f286a130
SHA1 86a935fbd2fd9f5b39307ef986146cb2ff2adc33
SHA512 236bf295e0551ba64d743833ffc5c1d1b5b4915c9df5ccf3300013c765befb37808651087c388962e2f7bda0a143a406f923f408a24373cee9e6cda49aae5b73
SSDEEP 1536:7Jr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016kyBekazo:7Ji6vPUL7zxwXmh8Gf99XZ7Bwk
TLSH
T125A3F81483FC4F61E6F71B742DF6A0814A72FA625EA2DB1F102D410D1C63B949A62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Size 27KB
SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
MD5 d0958d7bb727740c9d9952b1805163fd
SHA1 a3b18971219311fd6a7e5f2be14979c3777d4d68
SHA512 138bd86e0b1f0b32ba453475e1fa81e11e9d4300db197b58301a5d478b3213079dc30c700f52220ff957fef10c4c85d1230308d83cf7560547b475fb346e1460
SSDEEP 384:Sp0wdaXOa1FnKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81dWIY83gWQsLBiHR1:O0Ka+q+6rqnDPOyBeRmoQ9zpI
TLSH
T139D25628D3F85312E2B38BB099F5C447AD76B953AE34C7AC2596534D0C227849963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Size 31KB
SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
MD5 55c9882d7612e7e8b69fa5920410be3d
SHA1 9517d22cc6d9c7f9b64d2c8152849a9075027c91
SHA512 a6fc94a8a0d6a690493819efd463b5263871346a94e7a1caa379871dd1fdc6527311b02eec70c5b49406aec53bf4e2d04d14c592754bdd3f6a251e64f9e2b024
SSDEEP 384:F52RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYWcsLBiM:3urKjgEnGEFiJrvPAOyBeF29zKk
TLSH
T1A8E2962893F81312F2F35B70ADF5C483A937BA03AE35D76D2586174D08667849963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll
Size 117KB
SHA256 cf7b8a47428bd4f204bf77509dcd2f3e5891f65d4f0a367ae45f80fc0e4d6594
MD5 e1b99ccd7cd33bdf1b3377ea678b2b46
SHA1 f9286981d561a0705f8371d9b5989fac71190c58
SHA512 3a69d0550d3115c6b5ebbd567efe4183f16439e93e54af3d229f6b27e9a136db14ecceb40ec9cc476285895df79a7238d296746448f5fbc22c579132a1f747fe
SSDEEP 1536:g4OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQnsPyBeA2zO:grjoi6vdu0Ow6tKGfU+IN93sqBA6
TLSH
T163C33B1093FC4711E6F70BB47DF6E0419A72FA635EA2D31D1999460E1822F94CE62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Size 137KB
SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
MD5 b5c91699e57a807b2143cced62e70e77
SHA1 067f80a3c6b16ff9c4acff06099393084b6368ff
SHA512 d843235998b04d8f857239b31b5866c5328de3455b330f57be5f61acccdaadfa174231cbc57eb07f8cc5f7f3d8ba598fa0399fd8d13759d3c428d31a07265003
SSDEEP 3072:nEmV8EKUaX1IrJeE+6pwluGCulHxTqo+UeYBs+:nEm5azUaxWIN
TLSH
T120D33B11B7FC371AF2FB0B79A9F96001C97ABC556A26D78D1851424E04B6FC08A32B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Size 79KB
SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
MD5 2c100809815e27163493ea5e81010d1c
SHA1 01ee717e6f9d6c3d574ffe82c1cff3cf2467419a
SHA512 c22de3606e5cd1a9ac2e1cbca3c156831d5cbb99a50e4ae9f34df7d93b4d9093447d62b3fdc031be84a6c7adf16e23f7b5b44ba4eddf21bca13a26704d8a6b63
SSDEEP 1536:QdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHp2gXmyBejjzQka:yYR63P8dlNGu1IcT7TXLqngXNBCjkka
TLSH
T1F983391193B88327C6FE43B464F0A8125FB9F253BEA6E71D09C5A39A48537C18D5272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Size 85KB
SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
MD5 33247411fefa060b5f86eecd66b95078
SHA1 74784f9e3da6f1579a22f5723d46c5de50add359
SHA512 c1ad16c956cde61fee693b1483905ab6711841750bab35848a1e7261165f37273d8380daf8e6f4d2d35d520ec52fa943938f3ae7ea056a112bc9200d7e49c136
SSDEEP 1536:kkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79sShdX+yBeS2TzR:kk3gCbzexZG0YUBXfqidDhdX1B+Tl
TLSH
T18D835B27A3E85713D7F74630A8F09A03AA71FAC37565D39F2046672908AB3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Size 44KB
SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
MD5 c2e0ecbe64eb072ed008257142315526
SHA1 3d732f858fe67bae8f369ef19ef282e11a83f656
SHA512 5e0d2a7484e63254e455d6e9da44f79533638607e41d7c4eaf77529f6dee50904a675d8695a8e5c0ac835e813f2a7e11e7b1e0cfdb82553edf653451fe816203
SSDEEP 768:Tc1JB9Xaefxf2ZquXoQGaVP6rqnig3MbvyBeHO7Ex9zQB:A1JHXtp+ZquHVVigczyBeHljzQB
TLSH
T17013D72493F80313E6F757B099F1E443AA777953AE29DB9D1099574D0812BC1CA22F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll
Size 289KB
SHA256 cf4a264e243cfd6d9ebbdc100bc9b0bdc1bb178bc5c9bbc141407a11bfabd8cc
MD5 b7b9a43fbb8f9657cd79449e5eee1839
SHA1 feffed24c3e4d0f4c452400576a93954fbe42be9
SHA512 118d7426296644c2e7f3cdb3b3e99bd8e7b95a9c0d28b529292ed968b87d6e61e1fc66455e9ac935283d71c3aa1892f61da1fc24b85c4dfffcede9901eb6348b
SSDEEP 6144:g/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvdRA:P777376V7777U77aPMKIXaXce7mNTp8Q
TLSH
T10854F8A6A2E84F22D3FE037820F1554B19F1EC57C64EFB4B684092F52C177A0DA63967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll
Size 149KB
SHA256 364f386f97281ff3a80fbf5aa93207d35cdcf21d4a32fcf1a29c3861c8794671
MD5 5407ed386851928a55bdeb7343547e77
SHA1 7754cb78c8c6fd85c0c303a602fe93c6a3be2170
SHA512 fa3cc5c5723a4c4f7e355041162b3d55576c45f0f81076c2a14f9f92d996870a5a10cdf869773b76585d40bf5d0d52f15f4d6b8da718b4b22b4ea7132417880a
SSDEEP 3072:6AyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcjCBPx:6rIMFRufYp
TLSH
T11CE34A0963E81B1BF2F71734E8FB40825BBAB9077963D31F694D41CE05A1B848662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIa0fa1.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSIa0fa1.LOG
Size 1KB
SHA256 b1fb50dfa46f4613d88b7564ef820066ffc709fb7a8304707a31a04962c9dd95
MD5 da35b8c9876434d9c721b7d003c103d9
SHA1 0bd3da865c8b1048b4d735dd10dba15ac3bd79bf
SHA512 9f53129abe0c12274d26c28cc182974c387de2807722494392c9061dff58eb44360f0838b07143f3e75600f4af9c4ab10984dc4724761d83e541f47c169e3558
TLSH
T16E31A5A51FD50806B1F61727DEF3C0A24B73BCD3A8758B0C2344D219867BD06D8AC76A
MD5 SHA1 SHA512 TLSH

Submit Download

MSIa1166.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSIa1166.LOG
Size 1KB
SHA256 3328fc13465850447a18664c5ec70f15916c4909f6e431094abd25c1fd7bc308
MD5 9a100266a1bbf840ea2e65bb828b88e4
SHA1 fb8450d16c152db6300fd2404ae6bb0818f9db14
SHA512 26805f932057f56550ce3f06203519762621f12fd6c79d8dc953c43209cd25c4de7fb1566b83fefdca18d7dc12d683162a77411d9bd8e32795569b09d84902c0
TLSH
T1173108641AF50846B5B25607DEF3C4634F73BDD6AC75CB0C2344831946ABC06D8BE3AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260624004832.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004832.log
Size 7KB
SHA256 f51bfc7cf39f39b6f63cadb619eb783487a9de1c17796c9548bd5da7bf43fcf4
MD5 3138e9e9f83b4cce9d5b9d3774426582
SHA1 383402eed37a68c30905a42c715b14c906b425f7
SHA512 3e345fb268367308d3b1a3a7a3cf6ad8f5f12e0c89fbb4910d582e64726acc028ddf5f573a204df822aa985ce3d39b1cca576ef0b23fdb5adc243e554f37ba64
SSDEEP 96:5Cib945b/bXbKbZr/rOfvK11cyNY/Ga0xCbDbPbGDwzkUbGblCdbSX:fKzrqtjGrZLfjDkMe8SX
TLSH
T123E11D01ABF6B78819EDF1EEF1A04AD84F2539056E0127B06BD54BDC4C4B434D7ADE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260624004832_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004832_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 b2473999b627c25af655838b3f99d63968e2f2c3af33161a2898d833a169102c
MD5 c4152ac8b39ac4fcf33ea071e66b884d
SHA1 c5d697c1d42b13339d2d05009d894f91fefa6e9d
SHA512 24f8534077604a985558226f61c35ba988411f6684f804ea90f4895ace87be2a270ed607b84bb84cca2ca6f574c88a72503699ebc60ce3e396e0f3ca59cce5fb
TLSH
T16E41C1591FE90806B2F216479EF3C0535E73FDE368748F4C2348832A066BD059D6C76A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260624004832_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004832_001_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 76f51aa4ca929766d92207f44c0754afd08a00963d04fd94b55f0e5771d7f081
MD5 5865254eea7b02e8ed0ac953c60e40dc
SHA1 484b8a546321b326b195cc71876ed917a56802f3
SHA512 206a1b94ceefda8302b781d0e55b96d4d83fb70ce60145177d62b085ca2b473754899c04ecee5c44dc7d5e6a303f468bde64a035d1ab0d9ad1eef1f8c3fa5b78
TLSH
T10E41D2581AE50846F1F6160B9EF3C1535B73FCC269748B0C6389831A466BD05A96C77A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260624004837.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004837.log
Size 10KB
SHA256 c77ea5a2e3b85cadeae37ef804a484bf0ff7bde4cfa8109f80a2b27905cceb37
MD5 e20b2976aac3463fb64197eeac2accc0
SHA1 c45384bbf1e5699e3a7c9c853612856a05f5b5fe
SHA512 006466e5a60a7ef4afa3f6e9f0fe3cd2f7e333bdd86aaa638cd6fe7d6f151296a62e8296627948a89b96623187e4b0671ae10b45e04ba8d6d13429127ec9f2f2
SSDEEP 192:lvJn51117141E1r1R1W1m9HS9LE7X/U6Z1L:lZh9HS2XlL
TLSH
T1F832E203BBB9B6260CED8990F15B4AD98F1D75153E0024B496A436CC784B87AC7BF986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260624004837_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260624004837_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 2c74eafb2999c099249e04a72d7aa0c2916d6ba9486fc222b3bd53ece4ad915d
MD5 a4c271d350fc899cdf946b12f0afeb0b
SHA1 7d5cacf74eca3ad829a6e68fa7bd2da619e92af5
SHA512 14e57445ffceb425089b22f9ac236d3708b12f436f8c23a35f8a0706d10e638b3c3dab4fbccb6cd2b839f8dd7b9d74c789e61304d2b8508065a8597c6e4899f6
TLSH
T1F741F4691AD5084AB1F2AA07DEF3C0A31B73BCC36834CB0D2394931D467BD06996D7A7
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260624004835.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260624004835.log
Size 13KB
SHA256 41ca4ae58aa236acbf7452ecc56cb814763e15b1930dc63002786ea1c225ab36
MD5 23eab911116f2b606d5e490aa6dad91c
SHA1 15b0e12e3a216cc9ee5fb8565fb3e74723e32b4d
SHA512 0947d673add1bbd18d7f2e1ce8e570ec264f91969476a3b2c6ea14ac72f551692378ecaae72364674943548e489e2597fd63659ae82549cc9f99f8b3e09fb30a
SSDEEP 192:p+jn31z151e1u191D1A1bfF47GBCKmsTIq3YP:p2UfF4GmsTN3YP
TLSH
T1B2525302B3FAFA5819DDC69AF1951BD46F1C78093A80B6746766138C2C0E834D7EEC87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260624004835_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260624004835_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 6e62860c32533f8d47d229f12b8b03f2615e462e26a6f9a93ec2b6806628de09
MD5 e8748993bb7d465ec5daaeb706a330f0
SHA1 1ea4305d01e8e42021a1cdf04691f4dd2e265864
SHA512 0ed043accac72eeb4e2f98f8cc54d4fbb1856012955da01c638cdaa3e2d2044c15d064b477cd8d846e42124af5ee6f41c86aecef99b942267c81f266b4bebf52
TLSH
T11541C3642BD50845B1B32647EDF7C4621EB3FDD7A8749F0C2384831A466BD0A985C7AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260624004835_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260624004835_001_vcRuntimeMinimum_x86.log
Size 3KB
SHA256 048f230af068e8a9f8e14b256845fd3a1feeea2a37419c5c098a58d37e607bcb
MD5 eb203d8e2a0845a9303fea21ec17f626
SHA1 832238be35480dc55c7bc24846a9ba0bbdb7e0cc
SHA512 30f1c4ab34883c6d3ef46cb0005c854dda981dd986c9f3fe5bff394693cc05cfbc2f5ce50df08855e76aeec651e415c712af9c3d83e5a9324884b5aeb491cf93
TLSH
T1735185551AD90C49B2B21A47DEF7C4532AB3FDDB68788F0D3348831946ABD07886C766
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 861B
SHA256 399db8146e8442dc50c9391d05a2ce8a0cabd10cff836d71613d6a6b222c0324
MD5 ce0283e557416bf677754ea124557b53
SHA1 eef0d2bfd291c5902673c787cb43ff57450ee3b8
SHA512 a3bdb3cce09f538ba90e808b4bfac777c92cd1a8897b4dc96ad054abbe5ba12cdcac653270a4a476eb02964724f5f53495a08f4a8cb83bae4e7f4c658b1df360
TLSH
T112110A9155244152B9B321000B2745602FB59F1A30D7CA1A41C9D963372BFCFC4AE38F
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 555B
SHA256 c699d8ff4603d06dbc808bf03c3a878ed38d066d674ed73c9a72bc25293424f7
MD5 1fd55bb762d67c10619f86788d8bfd9a
SHA1 1429193e309efd1c6146cdba6237001f3c483be1
SHA512 398a01debb737e3cdc6040b3b020aa7e93fb09539d0a0eac129a5fc7c37fffeb35402f1f3ae65d5ba0017b6bf76b8895a9bb5a97edbb81ddd1ff0ec216eb789d
TLSH
T184F0965246744026FAB17201075F49182FB9976A21D78B0565CCE541233BDCBC5AE2EF
MD5 SHA1 SHA512 TLSH

Submit Download

msi32.txt

Path C:\Users\Admin\AppData\Local\Temp\msi32.txt
Size 615B
SHA256 fd7b96c0ef71f1fdd0a0e3000844cef5f15291075057e3c82708275c92532a6f
MD5 22cc396b7d4c9c18b4d8a7210e7f0ebd
SHA1 283bcda3d8943862c917cd0256be9bfd16ac7c04
SHA512 4130741465daa8cd834e9b6794e0a2b41cffc0b51a9228e76280828e6151aa5f379c8f42f6cc131bcdc369959a0455029d23b0b8775c5161bbabf7fdfa7e0c10
TLSH
T174F0A49259240153FAB321100B3788642FB9DB2731D2DA1A05C9E993372BECF84BD39F
MD5 SHA1 SHA512 TLSH

Submit Download

msi96.txt

Path C:\Users\Admin\AppData\Local\Temp\msi96.txt
Size 555B
SHA256 0872bd9b0ba1ce16bb11e33f8a766fcebea4b00a48b198f4a945bd4032fc04ad
MD5 efb1bfe7c0c9e330ae7777279e54bdd9
SHA1 edc3b070da0e78f43a870fd20e6cf72eb327b5aa
SHA512 7bdba2d23b11a828d70d84c22b9f8f360dd607ea705d716d38c2b9da1df47cdf93ed92dfce706650e64fc714bc632a896ce65eed81714d5fc7c6415e54492d0e
TLSH
T185F0CD4185200026FAF2B2010A5F8A143FB8D66B21A3DB0552CCE681333BACBC4A92DF
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm1525.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm1525.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm1525.tmp\nsExec.dll
Size 7KB
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
MD5 826ab855bf3d4cfbe442e5c29341c742
SHA1 0f76eaef902a256221ca8d309b46e480113669b9
SHA512 d053526e1ec45b6667699689e80ff30237a860dfa35bfdbef2885d8c525e47b3886fa17e3ae2b35e69601305ef450ccea60dc85e6023cf0ea3e20777a26ddb02
TLSH
T1D0F0E28696214016FAF322100B1B49553BB5DA2731E6CB0940C8D9A37627ACF84AD29F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
MD5 89d42ed52b434f87f3408bf635d31183
SHA1 152a56d81427313371addead21536d631fc8c7fb
SHA512 392c0c0b574b88b790a35dc4c295723f14e5a02b0fb8e8705ae767131312fc9aee7fa41411f808a35c6408b8932b8d920020092f9ac518542da0fa5d30d356c0
TLSH
T13A01F58656214017FAB322100A2B49642FB99B2731D7CB0A11CCE9937617ACFC4AC29F
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba2\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1070.tmp

Path C:\Windows\Installer\MSI1070.tmp
Size 74KB
SHA256 be2ead50c4cd94d33c7f1e7c00b47744cb4b4309dcb349236cdcd447265ecf4b
MD5 d557e10dd63535aae79b780fbf83961d
SHA1 67fdf4459fab259f61da7ddd342261243b916a94
SHA512 ab7d5ec81a3e4367b51deac213da79f9b3a6f5be505f4900121b19bffee4366dabf9674753f6ea82e35a88080b85b1e0f2eca790630f879f850aa322e4068feb
SSDEEP 1536:C/sWkKt5Qr09UcBO8IDNg3D+VYBli7woHKy5bJuR3nW+d:SJ5Qr09nGe3D+VYawa5bJc3nW
TLSH
T10B739D213651C375C19728B5E57AC2716A3E74201FE488CE7BA60B7E5E322C17A7B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI1F79.tmp

Path C:\Windows\Installer\MSI1F79.tmp
Size 97KB
SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1 a520426523be085ec67291241f4219ab13f4d4b8
SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
TLSH
T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI21C5.tmp

Path C:\Windows\Installer\MSI21C5.tmp
Size 165KB
SHA256 8aa9ee293b304e3368dfde27d35538f9676f3440ec5536e58ba9fe3ff7841d68
MD5 1202b90ba913a9b5b227749967d63b57
SHA1 1817119db41ec35139aed53440f3417969799d64
SHA512 851d9163caa5efcd1490d55f8238c7c338ffc3ced17021847406a1890f467a60efab4e19549aaaa82ee809ea46f882d1eaed8913d759b7e675e2e99bb3a7496b
SSDEEP 3072:igN6wMs19DGwTUxlwZRlKCCDjshYsnY0T5aPX/lfgQyVqkHKBFdI:ihwMMDjTUsxKCCDjzsn98/Bly7MHI
TLSH
T151F3F78173E80079F5B3E678DAF54656AB7378429B39E3DF0250426E0E72BD0AD35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5DE.tmp

Path C:\Windows\Installer\MSI5DE.tmp
Size 83KB
SHA256 ff95ea08d4eb2a9879c839179b0a0bf223268afe84430f23582208c814ee19a1
MD5 08895ffbb06b9e35893a77b8d613bc53
SHA1 8826feda89dc5905d6c327aed3aa839a510b96be
SHA512 fe213b0050b9346b6c7a8583be988870e7442c64407fbbd98d952653e206037c108780dea9f0ea9c51346d021935231a774b040ecccaa6123869e6318517b1b9
SSDEEP 1536:aChZ5oVlwKpAQOxQ+/hvFTTMJ0vR2JeLEUTXFTk2y3OI:vhZ5oVlSxLvFTb0JHUTXFT3y3
TLSH
T150838E2275A4C17AD0AB5976A539C1711F7EB0301BB0C88B7B560BAE9E31281B7B7317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8805.tmp

Path C:\Windows\Installer\MSI8805.tmp
Size 219KB
SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
MD5 928f4b0fc68501395f93ad524a36148c
SHA1 084590b18957ca45b4a0d4576d1cc72966c3ea10
SHA512 7f2163f651693f9b73a67e90b5c820af060a23502667a5c32c3beb2d6b043f5459f22d61072a744089d622c05502d80f7485e0f86eb6d565ff711d5680512372
SSDEEP 3072:FVzl3qiEZybztEwiUx6D02cWVsV1v2vZR3X6j7zo6k2FkngTLrOrORT9flQnS6lg:FVIMEgXmEAR3oHon2VaFuG0eEp
TLSH
T1AF248D217494947EEAFA0832A57EDA71BF3DF2241760C8AEC3409D1E6D604C167B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9BB.tmp

Path C:\Windows\Installer\MSI9BB.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f2d9.msi

Path C:\Windows\Installer\e59f2d9.msi
Size 26.3MB
SHA256 2e23da54aa1ff64de09021ab089c1be6d4a323bdf0d8f46f78b5c6a33df83109
MD5 b9c6d23462adef092b8a5b7880531b03
SHA1 9e8c4f7f48d38fb54a93789a583852869c074f2d
SHA512 18623991c5690e516541eaf867f22b3a1a02317392178943143bedc7f7eda5e02e69665c3c4a5fa50ade516a191bbbf16fd71e60f3225f660fb10ebc25cd01a5
SSDEEP 786432:Y2a7yZcd+9F/PHkT4Lqt85HrI5K4Krj8A0Lr1k:Yvg9r95Hrh4c8A0t
TLSH
T1035733537ED29422E96E5DB648BAC325433DBD248620E84B6394791ECDF22C05FB4FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 157KB
SHA256 9f90de4f278cb74ea8898ce3ac948ea218aeb6f3fe36b1d06cdcf9d469550d42
MD5 9c2044979147ac2e93e9086c5a1a6e3c
SHA1 0d5f0c2b6e17c0a05a4457d9be4e6bf3add6013d
SHA512 6156a8c87dac377d778d22efa4dbbbbb21409d4df577278b28deb9b66d203c297aedf8ae47923b3244b7d80c9bd4975f257df76340f60abc0ff8936c0d2b7bb3
SSDEEP 1536:PO1uWuuA+Vsy8guWqAYC8Cm+S0qQWKaCX4T0Cy/a+GWiSsgw+mibNpE2mK6qQKC2:ZyowDTc7/dqiI
TLSH
T1DFF32519122D51916E9367C218AC2B97A3CF4B9B6BBC0B6CF678361C9E5704F63311F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
Size 150KB
SHA256 04082e9838fb0fda385830c2c8e2d667842ab0bf57c07da2a0f4b80cc0369dd6
MD5 3909271cd3e8ec6615d12dca1ae237e0
SHA1 97df7a9a73891921499a17ea7596c7e317bb98a0
SHA512 eaae823ee2f0095807e034b65642eb3a6debce0f3c67e2135eef7708d7b2b8e1dc808d99d9c79cb424d4db0275b73d4089ced90dfdcb5bd06c8717754c48fb55
SSDEEP 1536:JSd0iaGysACM8UuqeVhgqXsOEaG6SaMsISdq2soCUP6sGkWGqCDVMlZ0yiEiJ1BT:eMfPY
TLSH
T189E3F61D201D91926D92674211983797A7DF4B9B3BF80B6CB7783A2CEE4704F63391E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{71161963-87F2-436F-A6E1-998D954743C5}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{71161963-87F2-436F-A6E1-998D954743C5}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.png

Path C:\Windows\Temp\{75FA9C28-A79D-4EF5-B8AC-4D4A70D0C857}\.ba\bg.png
Size 4KB
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
TLSH
T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-8.0.11-win-x64.exe

Path C:\Windows\Temp\{75FA9C28-A79D-4EF5-B8AC-4D4A70D0C857}\.be\windowsdesktop-runtime-8.0.11-win-x64.exe
Size 608KB
SHA256 4aae588970b5de7e67c0c46b19d7e671e8186d5fd7082c1f602f57f1ced0e516
MD5 fba0b1010e82ee3896e104749f505f54
SHA1 e7e43e8da6af9cd6a6b740b8f70caeb5fbfda730
SHA512 91bd3515bde8cee82529636025f70b3ca9447338417b6b4f37074e57d5fb810be030f92b0a42fea0d4692979250c01462a41c2477dcf972f1f7554248af16543
SSDEEP 12288:DmEsd9PZfePv3xl7ft7V+6uC+zd5qLl8N3wLDiy7nlEM0Dnma:Dm39PZfePv3r7fm6t+jqpu3INzCM0H
TLSH
T17AD48D32A5614032E7F106B3B928D6303D3CE328275488AAE7D4AD1D7EB84D667F7257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{C4983C4B-B415-4C3C-B912-D39FE9D5008C}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{C4D98FBF-F50C-4377-8E3B-4F6BB08627B7}\.ba\1033\thm.wxl
Size 5KB
SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
MD5 d5070cb3387a0a22b7046ae5ab53f371
SHA1 bc9da146a42bbf9496de059ac576869004702a97
SHA512 8fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
SSDEEP 96:MT0abTxmup/vrCKATQdYQHdYCwgoVOBq9LjP5dbSE7:OQNkdYQHdYCYXt7
TLSH
T1F1C1DBA778CF53C128731255EA925AAA5911C19C537F2DF4FC8B454B838A827A373F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{C4D98FBF-F50C-4377-8E3B-4F6BB08627B7}\.ba\wixstdba.dll
Size 190KB
SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
MD5 f1919c6bd85d7a78a70c228a5b227fbe
SHA1 71647ebf4e7bed3bc1663d520419ac550fe630ff
SHA512 c7ff9b19c9bf320454a240c6abbc382950176a6befce05ea73150eeb0085d0b6ed5b65b2dcb4b04621ef9cca1d5c4e59c6682b9c85d1d5845e5ce3e5eedfd2eb
SSDEEP 3072:sjEoXsLW9OLG8Qp51ySdjDXY33b+Av7O5IkI+/AYkPAEc527uu3k/gLtxavf0ir2:sjEo8LW9553hXWy15I2YrAW7FUVEihs3
TLSH
T1FF14AF1176D0A07AEBFB16307A39A5216E7DBA200FA0C9DF63449D2B1D715C19B36B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll

Path C:\Windows\assembly\tmp\0D66ESF8\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Size 134KB
SHA256 df0deac24f6371b26da9f34c1ce21e7d3fb7e4a4d75c42745c265b4639cb3e82
MD5 d8d3a7296bfe05f2355f96f526f1dce7
SHA1 f1ec56517cce54f75fc3b8cb3f82f901cb3d96af
SHA512 67f3816e595f472f3d67983e7207cbd643a2ccc3f6187bd94f2ca32dc2cfac3fb7daee7b5b05aa8ce46d829b99687cdfa4f34e802835b90955b126cfabadff48
SSDEEP 3072:ON1zvAuFvVyV2sUz8mqc9AaZiNhxm0bBzC:OTv5tAaKWQe
TLSH
T186D3D41B93FC0269F2B70B70EDBE94CA5877BD566C21D25F044A764E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\0PFS94K6\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Size 38KB
SHA256 b2673e6faf166a80f9f3832234508d25f3d219eafb6ba1d8d16583aff3517793
MD5 792d885a3d06f829956b3f0461789f4f
SHA1 f5d023f2dfcfb369bfeed2815da8c1ca54a948f4
SHA512 55e82a9ac9a9bf8a3f3dfbe4e529629a11a1df48774874509b71e062d7f754178b3a87f49d8d46580cf3aa9af52ba03747c980c8422456538d6c52102f1ce24d
SSDEEP 384:Tght+fMtSM9jmxa1CFbdKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3HW88NWXsY:TgX+EtkqP6rqnGKKyBez69zo
TLSH
T18603B629D7F84312E2F747B09CF584837976FA53AE38DB6C15C5934948237848A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll

Path C:\Windows\assembly\tmp\28L63D78\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Size 192KB
SHA256 e51a6c5e34b5e1ac743fca62a8c8d82f3e5099914745664a23843f6276e89039
MD5 91cc9825305d8554054d097b5418d7fd
SHA1 750eda13cddadf3f38de3df25062cc4774e019cd
SHA512 c1c82bd4859e0db7763f6e11425eb02270cec54ce79c0f848e1be5cab2c1715b7e9a96f12d9d2f11d5418881596837b3fbf84254be9e77e84b01a2b11c646802
SSDEEP 3072:0cs+QnXsia21rUBJeImxRGluQriZY+/ZCX/kMrICBX0a:0csrRIHiBtkb
TLSH
T1F3142A2467FC1B15F2FB0B7AEDB5A0019A76FE662913D31D15A0419E1872F80CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll

Path C:\Windows\assembly\tmp\4AP5WZOU\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Size 200KB
SHA256 0f5b5e40b8a1708051250bbc9e36ba35357312503beb0004ae6a2cc5a20466e8
MD5 9828dbd687c6ac093d40dfd61de68a0e
SHA1 9c96f865e83d7deae884321e76c87553c6088748
SHA512 001852557d9bbc33cb9b274277d2e24b63b1d46b253674f13eda857f36bf0718779242621c14809f902df041283c8302164d584a4e42be3ed11a0cef591f7853
SSDEEP 3072:SrFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirP+R/x3zKFvlBz1:SrFAoOXcHfIfiKkvx
TLSH
T11C142910A7FD1B25F6FB4B79EDB6A0018A36FA263D13D31D15A0419E1876B40CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.dll

Path C:\Windows\assembly\tmp\7T7BR2VA\Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Size 204KB
SHA256 ed512630534121de6e87259230aa7d67547b810bbe54757b561c9cd86428a316
MD5 6cf6471f917d139fa7f6b57a09156a8b
SHA1 896f482ed5892beed0cf3d74cfd599c2980d485b
SHA512 2192f731aaba560bb91e85ca5282943dc7c4bfde708690808487cb966c1051ead73f63a71f75cf52d7fcfd9141fb82c3f2d1edebaf21ee87601aa5deeca82cc1
SSDEEP 3072:00uKb2fEejyG2iPklibcruOVTzk21wxqWX58Kn8p6/A/C9hSrBbQ3t4N3BMjkf:b8cXqcfDKQCGP
TLSH
T1F6144B5663FC0726F6BB0B35D4FB11026E76F8172A53DB0C688A469E1971B808A73737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.dll

Path C:\Windows\assembly\tmp\8335X2BG\Microsoft.Office.Tools.Outlook.dll
Size 58KB
SHA256 89d6f51dbcddb10ea2c4e92e6360e9fc2c917cd8d9f1aa162d6a47f7e940d899
MD5 6c7bc83cf1080985bb2505ed9c090c86
SHA1 64fcb206e3280b935c786d72ba34ad854bf74c7e
SHA512 8b2a1d334f01e7997bb6b5c7752d9a275714b811ebb293e95bd9b1be7d2bb44484998ab1fc1845fb7e6f4df4613082fa4ed552a4994961fe611a92b93e0ca9e3
SSDEEP 768:jRXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24nbxocNAwkEGjhl2BOBaBnD/sxFsN/4:SSk2HQq9D4bg3yBeOkmVzpqZ
TLSH
T1BF43A382920A96D6CC55A5742A70FB52E63EF3FB1BD0B65F8813DCF408A3250E905F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll

Path C:\Windows\assembly\tmp\9GJ4LBNV\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Size 64KB
SHA256 e36435590e80c1d27493fbb9cc2f7a402fb3207e7210d134233099d1c01cbe8c
MD5 64939e920a0619adb8e395877237b560
SHA1 c05ecc9674f7a9436a227da429b474910a163d9d
SHA512 05281db2372f72aa9ab44ac3dab79a3e506390ac6b317180273a32d6a4f82f36128b75ad7e706333dfe318766e21ec8f42a72e55b875faf86e152d4d592b624e
SSDEEP 1536:ZZan8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsmjhGBDypyBeQjzQC:lMPG7wqLDy8BtjkC
TLSH
T1F6532A2893F84723D6FF83B8B9F191435A76F543AE61CB6E18CA938908533D4491376B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.dll

Path C:\Windows\assembly\tmp\AB0XE5JT\Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Size 84KB
SHA256 cd56f6c0e64ea02f2a76c880a55721929dd7a2d9eced52b82122618dc2b34c18
MD5 1150e66eaca3d36ef28a7551337b6ac6
SHA1 ad37ef180a8d1c81cbdf1595bdc802ba070cb03a
SHA512 a2862ac8fd62d4261427c2217d9c02d8df5dd7f4d3a0db0bd826421050d6ef8e39e8f630f079622905dc343e16f42c1d80724e1d4132d4c9d068f089d50084c6
SSDEEP 1536:nb4VV8XW/Og9NCJ7qBEPzm42yEAWQ0yBexjzQEsC:n2dWqQmyz1LBUjk8
TLSH
T1E383195587FC4716E6B74B70F9F78447AA33F967AA23C78D1408824E2851BA4C4E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\CWZDGYM0\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Size 38KB
SHA256 d182d18bbf9526dd0eb821eabddc885b80ba8f6dde2c9e0bb809fb55c14c7c47
MD5 32c152242c691677b866356014498d2d
SHA1 fc75591a894f0e8b5aecbd0bd13e3184df0c4f38
SHA512 bdf69a1b755f176e958f6d4c4e2e7c3ae74000a43266873ba602436c089983d0ebcf6e26344a15d8b2001ae74a798b5dacdbdd7cbc206426783704b036e05831
SSDEEP 384:bKQOJrYa7mdessomj5R/yeizfa19crXKJ9Yu6dnPU3SERztmCJMadMardz/JikPF:OQOVYoxVUq+w6rqnzxAzpL5yBeL19ze
TLSH
T15A03D628C3FC8326EAB347B0E9F5D4876937B553AE75D7AC1589630D18227848523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.dll

Path C:\Windows\assembly\tmp\EX4K350B\Microsoft.Office.Tools.Common.dll
Size 93KB
SHA256 1f9e5b3df61e6ae400905e38ef3e3c8208698a488305554dbe9293887ffa6478
MD5 d75541051253a7528d7c14d60fdb3e27
SHA1 e03b4457b01aaee52fb01967a781d10001c6329e
SHA512 5399fdd80de5492ba106c8b29d87d4a6ab0ac329ab1f882c13662a1807b86dee5c2fb667ffd39b87d664b0baeaaa30738aae7b516e048a0f606abc01a9647cce
SSDEEP 1536:ey+zGztUjm2oNIv5oiIZZB8CFD4W8yBeNzfzx9:tzhNw5yjVDB0bl9
TLSH
T1CB930626A23684BDDDC9103C74983531A73CF3B78246A7871909BDAA4DD3BCBC987749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll

Path C:\Windows\assembly\tmp\FY5C1M5G\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Size 27KB
SHA256 eb5162b64d9b6220aacaea4eaa597bdd02880b841db717e4bdca5d64e453b4b5
MD5 e7f28e9b4375963610ea0c6b7cfa09b8
SHA1 0f2157b7bd33fa24a7ba4274c9e5aa05c88a36fa
SHA512 c683d2faefffc02e73d500b40eb91a6055b0582ed16230c47c8030a4b5f8533f075354fb427faca1fcaec6b158ecd015ddbd481033159c2b43a40339a53f163f
SSDEEP 384:rd3K6a/IZa1fKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CdWbspWLsLBiHRN72f:rd33qo6rqnL56yBeucts89z+1
TLSH
T175C25328D7F84312E2B35BB09DF5C487AC76BA53AE35C79C1586530D08227858963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\LUZZN0SX\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Size 360KB
SHA256 25e23e4bc78db831a05fad7dc758354a932278b42b1b7277b62a75c717e89edf
MD5 5cb69e557b5b117597246c9e67cfdc8c
SHA1 f36af240ff34cc7c11c6ae1f0d67a0abf1496576
SHA512 9af38e10fa70186abf4088e86a9b45b79b4e6a41d20348f56da07fd8415ebf5d3695b8ef41962bb39310f5dd3436c2cbe70ba3982c720d7beb7b80b5ac6b1616
SSDEEP 3072:RyWCQQzXgPice1NvAbugFh/jLqthte2Seh66LikrKwQp91sq9kAatVrmCK2phJRS:UWCdDiyvgmiL54AaXDBP8v
TLSH
T1B174D62073F95208E9B70B30AC7692C51A76BE677E15C62F2449314D6AB2B53CB23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v4.0.Framework.dll

Path C:\Windows\assembly\tmp\NEGCT5C3\Microsoft.Office.Tools.v4.0.Framework.dll
Size 30KB
SHA256 8b1af886189a4f9610d1e38aca9d71cfd137e0ecb326d7c46cae9264c3faf097
MD5 7fdb0de95e06f278b3a08581f25a435e
SHA1 f7b03fcd3c6d8c4dd1e65a689a73acbfe5c2a3ee
SHA512 8a289b9c4c82c3d8c22bfdaf57aa0416de14f6bcb22e9a3e10630fc158c65c48fa012a8946423950a65722fcdd0f3c643fee116ad848bd802aed4347a973c19e
SSDEEP 768:aHaVFSvPSNEtyJvrpc49qFkByBehN99zeXDF:Y29rQFkByBehxz8DF
TLSH
T19FE2185087FC136BE9AB0A707EE5D8815D3AFF526D62E21F4058C05E14F5BE4CA62327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.Implementation.dll

Path C:\Windows\assembly\tmp\OB7V57B2\Microsoft.Office.Tools.Common.Implementation.dll
Size 354KB
SHA256 1bc4ff4e9cc85d9457e80276354f643028c01c25414d0e81450bb52ed802e93c
MD5 00ee8a57705bf407a2fa0606b144a13c
SHA1 3c9a6ed3cdb6d167da2ac38518c3820985e4b6b0
SHA512 9197e0ce0e8979b7d8c8e5b95ef5b9bf22fe8cc803b26c97b3c44d1d9e095f85a2a205eaa57152a9843b8fdb7751bdbc1e64cb3f3f04d3952537428cb427fc93
SSDEEP 6144:iNeM8oM6s8alZ+afj5OAKOQ4pUE9wttHqr:O9QZ3j5IOQ4pUE9wttKr
TLSH
T18874A415A3FE5761E2F70B34ACB40489DAB6FD479E6A974F2445A14E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.dll

Path C:\Windows\assembly\tmp\PH6S4UK4\Microsoft.Office.Tools.dll
Size 18KB
SHA256 02d0d460ec66aca17204ef8f7244e2e34e117c7f20aa07e98cb83a1386a1146f
MD5 c7af388d0d92544cbc307cc692f6dc1c
SHA1 660b07bf79682e91b23824fa327950bfa8c73f01
SHA512 5a8d81ed8fce9eac5175c676f7db4cc147f4f2999cc9e010de4bf87c79bd106c45d0c8848f1cb0eb61a7ad7cf33d2d4881f9cce588cce4d841bcaa66ec8f187e
SSDEEP 384:H1LtwmrH+WAnmkW/MwWVsLBiHRN72lkPtHNsAR9zkwm/:H19AZvyBe6kFts89zni
TLSH
T192922A55D7DF8EA3CC622C709DF4D7423E3CA7835D12DA2B0689E5192CB3394C521729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\QBI3MJSU\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Size 44KB
SHA256 436215d03a6cd3b30d6b2e7006aa4a83f7c3291f3fc0b4ad86ff55e70dac8650
MD5 1190dedce8f1b97816123163216dd096
SHA1 468d499041ab141f4233b23d53ffb9a203cfda35
SHA512 fe35ddd5a4a600cf840414f8859691f5894ee779517f3b069f97667e68f6cae54836d393091f828dc9541c6fd9dbac4a77fd53eb3840a8d3dfda8d21373fa710
SSDEEP 384:MBk39BmxOVst4SCtrpuXYa1pbr/0K7yEKJ9Yu6dnPU3SERztmCJMadMardz/Jiks:MGfZs5CZqlj26rqnuMztgyBepmoQ9zpG
TLSH
T14713D769D3F84712D6F74BB06DF1E4435936BA539EA8DB5C145A530A08233D88E22F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\QCX1LFGV\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Size 65KB
SHA256 12b2e3ab66fa23e2814d937bc24aae3591516e61c667ced481f66a3d55b66a4c
MD5 dd97df24a39663be2d217fbb4bddffd0
SHA1 9ac8d23ec7c8655ae5bb5a62eda61871030b2a4e
SHA512 f0de89568b550f23b60fb4b343682e7b4ffeab9c571127376815d22cbb3b93a2c6081831a24c7fde7977008a72ae4395313202af39e95095d2c3d8360bfdbbb9
SSDEEP 1536:4c7HHzMKpyGZ3Jr249XJqZqSbGJyBeMczZ1:4c7HHzMDG5JdJqZqGGcBC11
TLSH
T1A6632924D3FC4723D2FB87B468F188839A75F7836DA9DB5C1485532A08577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.Implementation.dll

Path C:\Windows\assembly\tmp\RE4X5B7F\Microsoft.Office.Tools.Excel.Implementation.dll
Size 459KB
SHA256 1e9f1d847daaf224c7b1ca265ecb7bc293b0df70b3a299b5da3bdb2978bc7df5
MD5 2c93d41b14f129c61d2993baaf2e002f
SHA1 96e54e9b760391683eb617baf03aa444d124472a
SHA512 21808de680825d1a1a2cd003bd5b479c2ae725e54071ebe4e8aff5b0fb000ffea3eba1ece98631ab3065a8cf6c2786c1d9059712931e2fba0410c7a2b53e31d5
SSDEEP 6144:y6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNiuNfVdKy9:y6jwRSvQh42RNjN6AVdKy9
TLSH
T12CA43C12C269D33EC2AE833750A226155BA5B2EFBAF1EF57A013C5E82C537C09D41E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.dll

Path C:\Windows\assembly\tmp\URXRMJ54\Microsoft.Office.Tools.Excel.dll
Size 171KB
SHA256 a4397784c26adfec3393dc421d27f826099a19f1d55b64a2e6199d977a37515a
MD5 acf3804fead07de2fc137e95a57494ec
SHA1 d8b82e20db36ebf1dd2b27d8f301e59c0fc62565
SHA512 e21e42e012a0599f99c812ce4cb520d9219ddda15fe5c05241b6aeb17d0df4103877c81877a75b55271b389fc12c2ad822c2e4ec8e72a750d17b8e22829c3736
SSDEEP 3072:VWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vamSxBAZirZANBtJ:VnMr8CSQ09ap6Jy65Rm2v22v
TLSH
T1730419C1AB0BE061DCC9563C38AA7B056F3CFBD295D2EB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.dll

Path C:\Windows\assembly\tmp\VOB9DTOW\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Size 78KB
SHA256 6ca890e728f1bffe2cdc670938d9c17729903f9eaade142775954ee5129b78b2
MD5 8ca4448d8a87d4edc29064678840a65b
SHA1 389ee39f6060e9b31a379e65d3c998a3dbe83b40
SHA512 b86efff7aff40a0d2750d6c4db6ed7095eb942720b972350f8cc87dcf3c666b09865befe885a57058eaa1e7aa3c5c56119324a445eabe246f52d236fff834483
SSDEEP 1536:yskby0ayhkM+TeVCB5+G9cTvdQc1bqMsDNb//pasgNiiHyBeljzQz:yDbyihcwqHba3NbSB8jkz
TLSH
T19673081497BA4FA7C2BA4378ACF1424256B5F403AB52CB6F18855F481C73B94CD13BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.Implementation.dll

Path C:\Windows\assembly\tmp\VS4BWC11\Microsoft.Office.Tools.Word.Implementation.dll
Size 337KB
SHA256 2585cc5fcf73680a5124d8e0a08a27d311ba903cd7bbffee7adbbf8d188c5f28
MD5 87d634d0fd6f8e13b0141730916d78a9
SHA1 8591e58967be097ab8f711395ec0b55f72d902d6
SHA512 cf0445d2d697f256d3421ee480eca5ad83d3c897c8477fd30828def534b2a45b72f5dd0e177dedad61283d28211707d7eec3661306b3c504203ac36beca377d6
SSDEEP 6144:FtlRAWy0iDCyVMvUYKZ+JICHNyPOc9Yh9g:FdXyyuMvQZ+/rc969g
TLSH
T14B741B154268C32BD5E8C235BCB136124BBDF293BEE39B2B613695A81CD37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.Implementation.dll

Path C:\Windows\assembly\tmp\W5SUI7S5\Microsoft.Office.Tools.Outlook.Implementation.dll
Size 140KB
SHA256 326bdb32503351a9b99fe69eb884a5a02d4bff0ff2c7b8b3ce9674fab9fcfc31
MD5 0f7bc383c04833cfd5e6d6f6d5b9f9c7
SHA1 29f672f4c8dfb820e42b54a9924e93ede94481aa
SHA512 d3a7b278a7244c13a887d2a50b8aee39af38fa8dc02f7566a3c9b6e02f25415e2e009cc118d923d22c55c223961657d832a445f897adb4a5649d70e9e9cd2d8f
SSDEEP 1536:oBjLPfRUqxc0O/t4DErSu9e7EMaggaqRuDPR6TCZByBe9zi:oBfPJUqxy14DEF9e7D3gaqR4PGIEBi2
TLSH
T147E31B00A3AA0B92D07555341BF2B542EA3DFBA72AD5E75F5411CED80CB3B90DC22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.dll

Path C:\Windows\assembly\tmp\X7HSDKL9\Microsoft.VisualStudio.Tools.Office.Runtime.dll
Size 393KB
SHA256 2bcd529d5c2edf88d3b658816d72d1207df773ffbe805e7b5070802782c23c67
MD5 8640c74199160c6e932a5f55cac9d9c8
SHA1 661d08a2ca504c0e056bf3ddf500d9cf610ecb42
SHA512 7c06470c6ac2c7bb8bdc4fdaa81c765c810208200f059fef2cf0ddb9d815fca705964fd062d187e4e189127096690ad5ae9f4a74c5ab12b486057141e3f46332
SSDEEP 12288:P1lzmzzzzfzxVzzdqzzzzHUzJz8gXUAaBn:NlzmzzzzfzxVzzdqzzzzHUzJz8gEAa5
TLSH
T17184E62073F94218E9B70B31ECBA41C51B76BE67BE15CA1F2445315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.dll

Path C:\Windows\assembly\tmp\YS6OYV7Y\Microsoft.Office.Tools.Word.dll
Size 142KB
SHA256 bf5406b6657cc7aca2db714ec375efc3ffdf4cc32a80f938b3dfa502ebdd26f9
MD5 b24ae31036dc11fe6239397a22e8c659
SHA1 40d2739f8d2c19db095db4ef4f1a9cb6bae7880e
SHA512 c713095f297a37458edba5f9bbd6e04e9407089b3f8e98f9c3c52e9711a8be01a3e7268ece3837d1e0438588c50406eacf7afa5bab08d2ceba68dde76ea27915
SSDEEP 3072:jrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO8+rCo7VBpdfh:jrwBZWkge7DuV/7Tfh
TLSH
T1C3E34A91EA35C259CE84C47D3E21BB00DB3CF3D644C2A79F4526FCE80A9B791C552E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll

Path C:\Windows\assembly\tmp\YSSR452U\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Size 155KB
SHA256 ac12705a2b9470ef07732f500bcd8b2844282be1f609f5aa74b0dd3f0268362b
MD5 7a17537e156d75e293aa693423fd0fd6
SHA1 2bafdfe9348c0a39dbfdca35d7a04d925bdc82a0
SHA512 ab38de8c226a7361d0b1d2adb3929585ebc214ea0b967e7f851891f4c2c451030fa38cd8c3978f881ccb90339e40272c0522aaffae8073e9a4c3467eb3118fa6
SSDEEP 3072:i0anyn/CiBk6HOIz42IJqFF/0/QAWwTrjeK4BED:2n+VEn08
TLSH
T108F32A5A63EC0716F6FB0731A8FA54416EBAF8132962CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-1626-0x0000000000910000-0x0000000000975000-memory.dmp

Download

memory/1556-1627-0x0000000000910000-0x0000000000975000-memory.dmp

Download

memory/1800-1728-0x0000000000B00000-0x0000000000B77000-memory.dmp

Download

memory/2384-1730-0x0000000000B00000-0x0000000000B77000-memory.dmp

Download

memory/2828-2015-0x0000000000760000-0x00000000007D7000-memory.dmp

Download

memory/3104-1938-0x0000000000B00000-0x0000000000B77000-memory.dmp

Download

memory/3148-3316-0x000000001C140000-0x000000001C14E000-memory.dmp

Download

memory/3148-3314-0x000000001C490000-0x000000001C4D8000-memory.dmp

Download

memory/3148-3307-0x0000000001B00000-0x0000000001B2C000-memory.dmp

Download

memory/3148-3309-0x0000000003460000-0x000000000346A000-memory.dmp

Download

memory/3148-3310-0x0000000003460000-0x000000000346C000-memory.dmp

Download

memory/3148-3311-0x0000000003460000-0x000000000346A000-memory.dmp

Download

memory/3148-3312-0x0000000003460000-0x000000000346E000-memory.dmp

Download

memory/3148-3313-0x0000000003460000-0x000000000346E000-memory.dmp

Download

memory/3148-3315-0x000000001C160000-0x000000001C176000-memory.dmp

Download

memory/3148-3308-0x0000000001AD0000-0x0000000001ADE000-memory.dmp

Download

memory/3148-3323-0x0000000001AF0000-0x0000000001AFC000-memory.dmp

Download

memory/3148-3318-0x0000000003450000-0x0000000003468000-memory.dmp

Download

memory/3148-3317-0x0000000003460000-0x000000000346E000-memory.dmp

Download

memory/3148-3319-0x000000001C130000-0x000000001C14A000-memory.dmp

Download

memory/3148-3320-0x000000001C9B0000-0x000000001CE7E000-memory.dmp

Download

memory/3148-3321-0x000000001CE80000-0x000000001D194000-memory.dmp

Download

memory/3148-3324-0x000000001C540000-0x000000001C5E8000-memory.dmp

Download

memory/3148-3322-0x0000000001AF0000-0x0000000001AFC000-memory.dmp

Download

memory/3192-1731-0x0000000000B00000-0x0000000000B77000-memory.dmp

Download

memory/3596-2846-0x0000021B9AA00000-0x0000021B9AA08000-memory.dmp

Download

memory/3596-3112-0x0000021B9AA30000-0x0000021B9AA56000-memory.dmp

Download

memory/3596-3105-0x0000021B9AA70000-0x0000021B9AAD6000-memory.dmp

Download

memory/3596-3098-0x0000021B9A160000-0x0000021B9A176000-memory.dmp

Download

memory/3596-3091-0x0000021B9AA60000-0x0000021B9AAB8000-memory.dmp

Download

memory/3596-3079-0x0000021B9AA80000-0x0000021B9AAF6000-memory.dmp

Download

memory/3596-3085-0x0000021B9AA30000-0x0000021B9AA56000-memory.dmp

Download

memory/3596-3072-0x0000021B9AA60000-0x0000021B9AABC000-memory.dmp

Download

memory/3596-3065-0x0000021B9AA30000-0x0000021B9AA58000-memory.dmp

Download

memory/3596-3058-0x0000021B9A160000-0x0000021B9A172000-memory.dmp

Download

memory/3596-3051-0x0000021B9AA30000-0x0000021B9AA5E000-memory.dmp

Download

memory/3596-3044-0x0000021B9A160000-0x0000021B9A17C000-memory.dmp

Download

memory/3596-3037-0x0000021B99D40000-0x0000021B99D48000-memory.dmp

Download

memory/3596-3030-0x0000021B99D40000-0x0000021B99D4C000-memory.dmp

Download

memory/3596-3023-0x0000021B9AA50000-0x0000021B9AA84000-memory.dmp

Download

memory/3596-3016-0x0000021B9AA50000-0x0000021B9AA86000-memory.dmp

Download

memory/3596-3009-0x0000021B9A160000-0x0000021B9A178000-memory.dmp

Download

memory/3596-3003-0x0000021B9A160000-0x0000021B9A174000-memory.dmp

Download

memory/3596-2997-0x0000021B9A160000-0x0000021B9A174000-memory.dmp

Download

memory/3596-2991-0x0000021B99D40000-0x0000021B99D4A000-memory.dmp

Download

memory/3596-2985-0x0000021B9AA40000-0x0000021B9AA58000-memory.dmp

Download

memory/3596-2978-0x0000021B99D40000-0x0000021B99D4E000-memory.dmp

Download

memory/3596-2972-0x0000021B9AA40000-0x0000021B9AA5A000-memory.dmp

Download

memory/3596-2966-0x0000021B9ADD0000-0x0000021B9AE2C000-memory.dmp

Download

memory/3596-2959-0x0000021B9AF80000-0x0000021B9AFB4000-memory.dmp

Download

memory/3596-2952-0x0000021B9AF80000-0x0000021B9AFAA000-memory.dmp

Download

memory/3596-2946-0x0000021B99D40000-0x0000021B99D4A000-memory.dmp

Download

memory/3596-2932-0x0000021B9A170000-0x0000021B9A17E000-memory.dmp

Download

memory/3596-2939-0x0000021B9A170000-0x0000021B9A17E000-memory.dmp

Download

memory/3596-2926-0x0000021B9A170000-0x0000021B9A17E000-memory.dmp

Download

memory/3596-2909-0x0000021B9AE70000-0x0000021B9AE84000-memory.dmp

Download

memory/3596-2905-0x0000021B9ADB0000-0x0000021B9ADC4000-memory.dmp

Download

memory/3596-2901-0x0000021B9ABA0000-0x0000021B9ABAE000-memory.dmp

Download

memory/3596-2897-0x0000021B9AB90000-0x0000021B9AB9E000-memory.dmp

Download

memory/3596-2885-0x0000021B9AE40000-0x0000021B9AE68000-memory.dmp

Download

memory/3596-2882-0x0000021B9AF20000-0x0000021B9AF78000-memory.dmp

Download

memory/3596-2879-0x0000021B9AC50000-0x0000021B9AC6A000-memory.dmp

Download

memory/3596-2876-0x0000021B9AB70000-0x0000021B9AB7C000-memory.dmp

Download

memory/3596-2873-0x0000021B9AD80000-0x0000021B9ADA6000-memory.dmp

Download

memory/3596-2870-0x0000021B9AEB0000-0x0000021B9AF16000-memory.dmp

Download

memory/3596-2867-0x0000021B9ADE0000-0x0000021B9AE3E000-memory.dmp

Download

memory/3596-2864-0x0000021B9ABD0000-0x0000021B9ABE2000-memory.dmp

Download

memory/3596-2861-0x0000021B9AD50000-0x0000021B9AD76000-memory.dmp

Download

memory/3596-2858-0x0000021B9AA10000-0x0000021B9AA1E000-memory.dmp

Download

memory/3596-2855-0x0000021B9AC80000-0x0000021B9ACAE000-memory.dmp

Download

memory/3596-2852-0x0000021B9ACD0000-0x0000021B9AD46000-memory.dmp

Download

memory/3596-2849-0x0000021B9ABB0000-0x0000021B9ABC8000-memory.dmp

Download

memory/3596-2024-0x0000021B99FA0000-0x0000021B9A00D000-memory.dmp

Download

memory/3596-2843-0x0000021B9AB10000-0x0000021B9AB26000-memory.dmp

Download

memory/3596-2840-0x0000021B9AAF0000-0x0000021B9AB0C000-memory.dmp

Download

memory/3596-2837-0x0000021B9ABF0000-0x0000021B9AC4C000-memory.dmp

Download

memory/3596-2834-0x0000021B9AB30000-0x0000021B9AB64000-memory.dmp

Download

memory/3596-2831-0x0000021B9AA20000-0x0000021B9AA38000-memory.dmp

Download

memory/3596-2828-0x0000021B9AAB0000-0x0000021B9AAE6000-memory.dmp

Download

memory/3596-2821-0x0000021B9AA80000-0x0000021B9AAAA000-memory.dmp

Download

memory/3596-2824-0x0000021B9A170000-0x0000021B9A17E000-memory.dmp

Download

memory/3596-2817-0x0000021B9A160000-0x0000021B9A16A000-memory.dmp

Download

memory/3596-2814-0x0000021B9AA40000-0x0000021B9AA74000-memory.dmp

Download

memory/3596-2810-0x0000021B99D40000-0x0000021B99D4A000-memory.dmp

Download

memory/3596-2259-0x0000021B99FA0000-0x0000021B9A03B000-memory.dmp

Download

memory/3596-2133-0x0000021B99CB0000-0x0000021B99D4B000-memory.dmp

Download

memory/4084-1939-0x0000000000B00000-0x0000000000B77000-memory.dmp

Download

memory/4260-2020-0x0000000000760000-0x00000000007D7000-memory.dmp

Download

memory/4332-1900-0x0000000000910000-0x0000000000975000-memory.dmp

Download

memory/4760-2019-0x0000000000760000-0x00000000007D7000-memory.dmp

Download

memory/4808-1899-0x0000000000910000-0x0000000000975000-memory.dmp

Download

memory/5140-4259-0x0000020700950000-0x0000020700BEE000-memory.dmp

Download