Analysis
- user interaction
yes - max time kernel
149s - max time network
246s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/07/2026, 23:23
Errors
General
- Target TEKKEN 8.rar
- Size 82.1MB
- Sample260701-3dblqshv21
- SHA256 b82d700bef238ba01c143406c53fcebb07b4fc90c38a0ee3b9046dd8f9af23a4
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 11 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\TEKKEN 8.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\_CommonRedist\xnafx40_redist.msi"1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe"C:\Program Files (x86)\Microsoft XNA\XNA Game Studio\v4.0\Redist\DX Redist\DXSETUP.exe" /silent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Microsoft Shared\XNA\Framework\Shared\xnavisualizer.dll"2⤵
- Loads dropped DLL
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding DEC309197B54ACED577AA378D7DAF2EF2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding F24B907A6B1CABC1AB654E5A1796D3072⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 65B6C670C55AB847673A6C316CE8FCE72⤵
- Loads dropped DLL
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding F62C582AC48D8EC1BCFCEFF7ECAE1BBE2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5F297F01F11E4ABFE78CD49BCB908D372⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 97E930D42686BB7CA0B010BD547137CB2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 31E0B22527780F89742CE05FD67E01DC2⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 0D9F2C263CF34E1B1DEED3EA19CF191E2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A9500E2EDED6FB2A1BD338274819729F M Global\MSI00002⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 794BB5F7B197413981DACCDA621A85C3 E Global\MSI00002⤵
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
- Drops file in Program Files directory
-
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D8B807597BD282B4FE45088AACEF8E18 E Global\MSI00002⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\_CommonRedist\VisualCppRedist_AIO_x86_x64.exe"C:\Users\Admin\Desktop\_CommonRedist\VisualCppRedist_AIO_x86_x64.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /c:" 5."3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
-
-
C:\Windows\system32\reg.exereg.exe query "HKU\S-1-5-19"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value3⤵
-
-
C:\Windows\system32\find.exefind /i "ComputerSystem"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v productname4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4733⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.61135.4003⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40664.03⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 50.35719.03⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F03⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"3⤵
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{D164A1C1-C669-402F-BB43-2919F77AFFB0} {64114386-6FEE-4581-9BBD-FE8FB16BAC63} 56844⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{83F582DF-17DB-4B6D-889B-E67F18BBBBBF} {B77471B1-CFA2-4BC0-AFEF-12B6D9521E6F} 33004⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{E6AD1329-2ED5-4A42-8EAD-0878F4F96F62} {427E8F71-7C86-483F-996C-A5EAA846C165} 39604⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{848D70A0-0FF2-47F5-8389-7BB228FA9986} {4D823FB2-D13B-4B7C-9750-4E207732A26A} 16324⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{05238717-B27C-4F6F-8BF7-A8DF7DD1C281} {CB9649A6-4E45-4215-9840-9B66977DCABB} 56165⤵
- Adds Run key to start application
-
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=572 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3EC52906-8F9F-4A94-825B-F7F0BC2F23B4} {9B0F98EC-CFCC-4F17-829D-472E464BC068} 7965⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString3⤵
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"3⤵
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.60917.03⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "TRIN_TRIR_SETUP"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"3⤵
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4733⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb3⤵
-
-
-
C:\Users\Admin\Desktop\_CommonRedist\oalinst.exe"C:\Users\Admin\Desktop\_CommonRedist\oalinst.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260702002554.log" /uninstall /passive /norestart ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260702002554.log /uninstall /passive /norestart ignored2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260702002554.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{5B977761-C840-4939-9D57-8426B555AF66} {D972FA05-F796-40EC-8244-0FBA4BE66563} 61403⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260702002556.log" /uninstall /passive /norestart ignored /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260702002556.log /uninstall /passive /norestart ignored2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260702002556.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{D179C4F3-E465-4DFF-B4A4-D58B32650A3A} {C36C1959-05D5-4717-9C66-00B88FFC9BD3} 48043⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260702002558.log"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260702002558.log" -burn.unelevated BurnPipe.{8D4675AF-8017-48C1-8AEF-389E0242BDFD} {AD7D0B57-9444-4625-8063-68903A0CF334} 30283⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260702002601.log"2⤵
- Adds Run key to start application
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260702002601.log" -burn.unelevated BurnPipe.{D2DCC311-28DA-4DEB-9091-C57F038F7D21} {209FBEFB-E4D3-4626-9C10-89E333DD0B8B} 40723⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260702002603.log"2⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260702002603.log"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260702002605.log"2⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260702002605.log"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\Desktop\_CommonRedist\dotNetFx40_Full_setup.exe"C:\Users\Admin\Desktop\_CommonRedist\dotNetFx40_Full_setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
F:\b1e8c5183c82ac024c63\Setup.exeF:\b1e8c5183c82ac024c63\\Setup.exe /x86 /x64 /ia64 /web2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Desktop\_CommonRedist\dxwebsetup.exe"C:\Users\Admin\Desktop\_CommonRedist\dxwebsetup.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_24_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_25_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_26_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_27_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_28_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_29_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_30_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe xinput1_1_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe xinput1_2_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_31_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_32_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_00_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_33_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_33_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_7.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe xinput1_3_x64.inf, Install_Driver3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_34_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_34_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_8_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_8.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_35_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_35_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_9_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_9.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx9_36_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_36_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe X3DAudio1_2_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT2_10_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine2_10.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DX9_37_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_37_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe X3DAudio1_3_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_0_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_0_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_0.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DX9_38_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_38_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe X3DAudio1_4_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_1_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_1.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DX9_39_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_39_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_2_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_2.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe X3DAudio1_5_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_3_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_3.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DX9_40_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_40_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe X3DAudio1_6_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_4_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_4.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DX9_41_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_41_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DX9_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx11_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dcsx_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DCompiler_42_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_5_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_5.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe X3DAudio1_7_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_6_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_6.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DX9_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx10_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dx11_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe d3dcsx_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe D3DCompiler_43_x64.inf3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XACT3_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\xactengine3_7.dll3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exeC:\Users\Admin\AppData\Local\Temp\DXB4FA.tmp\infinst.exe XAudio2_7_x64.inf3⤵
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll3⤵
-
-
-
C:\Users\Admin\Desktop\TEKKEN 8.exe"C:\Users\Admin\Desktop\TEKKEN 8.exe"1⤵
-
C:\Users\Admin\Desktop\TEKKEN 8.exe"C:\Users\Admin\Desktop\TEKKEN 8.exe"1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38d8055 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e58cee5.rbs
e58cee7.rbs
e58ceea.rbs
e58cefd.rbs
e58cf01.rbs
e58cf14.rbs
e58cf1b.rbs
e58cf2c.rbs
e58cf31.rbs
e58cf42.rbs
e58cf4a.rbs
e58cf5b.rbs
e58cf62.rbs
e58cf73.rbs
e58cf81.rbs
e58cf85.rbs
e58cfa9.rbf
e58cfac.rbs
e58cfb0.rbs
e58cfe2.rbs
e58cfe9.rbs
e58cfee.rbs
e58cff3.rbs
e58cff8.rbs
e58cffd.rbs
e58d002.rbs
e58d011.rbs
e58d018.rbs
e58d020.rbs
e58d025.rbs
e58d02d.rbs
e58d032.rbs
e58d03d.rbs
e58d042.rbs
e58d043.rbf
e58d044.rbf
e58d045.rbf
e58d046.rbf
e58d047.rbf
e58d048.rbf
e58d049.rbf
e58d04a.rbf
e58d04b.rbf
e58d04c.rbf
e58d04d.rbf
e58d04e.rbf
e58d04f.rbf
e58d050.rbf
e58d051.rbf
e58d052.rbf
e58d053.rbf
e58d054.rbf
e58d055.rbf
e58d056.rbf
e58d057.rbf
e58d058.rbf
e58d059.rbf
e58d05a.rbf
e58d05b.rbf
e58d05c.rbf
e58d05d.rbf
e58d05e.rbf
e58d05f.rbf
e58d060.rbf
e58d061.rbf
e58d062.rbf
e58d063.rbf
e58d064.rbf
e58d065.rbf
e58d066.rbf
e58d067.rbf
e58d068.rbf
e58d069.rbf
e58d06a.rbf
e58d06b.rbf
e58d06c.rbf
e58d06d.rbf
e58d06e.rbf
e58d06f.rbf
e58d070.rbf
e58d071.rbf
e58d090.rbs
Apr2007_d3dx9_33_x86.cab
Apr2007_xinput_x86.cab
Feb2010_X3DAudio_x86.cab
Feb2010_XACT_x86.cab
Feb2010_XAudio_x86.cab
Mar2009_d3dx9_41_x86.cab
dxupdate.cab
xnavisualizer.dll
DSETUP.dll
DXSETUP.exe
dsetup32.dll
vc_red.msi
Installer.cmd
filever.vbs
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
ucrtbase.dll
vcrun.msi
Microsoft.Office.Tools.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Microsoft.Office.Tools.Common.v9.0.dll
Microsoft.Office.Tools.Excel.v9.0.dll
Microsoft.Office.Tools.Outlook.v9.0.dll
Microsoft.Office.Tools.Word.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll
AUG2009_D3DCompiler_42_x64.inf
AUG2009_D3DCompiler_42_x86.inf
AUG2009_XACT_x64.inf
AUG2009_XACT_x86.inf
AUG2009_XAudio_x64.inf
AUG2009_XAudio_x86.inf
AUG2009_d3dcsx_42_x64.inf
AUG2009_d3dcsx_42_x86.inf
AUG2009_d3dx10_42_x64.inf
AUG2009_d3dx10_42_x86.inf
AUG2009_d3dx11_42_x64.inf
AUG2009_d3dx11_42_x86.inf
AUG2009_d3dx9_42_x64.inf
AUG2009_d3dx9_42_x86.inf
Aug2008_XACT_x64.inf
Aug2008_XACT_x86.inf
Aug2008_XAudio_x64.inf
Aug2008_XAudio_x86.inf
Aug2008_d3dx10_39_x64.inf
Aug2008_d3dx10_39_x86.inf
Aug2008_d3dx9_39_x64.inf
Aug2008_d3dx9_39_x86.inf
D3DCompiler_37.dll
D3DCompiler_38.dll
D3DCompiler_39.dll
D3DCompiler_40.dll
D3DCompiler_41.dll
D3DCompiler_42.dll
D3DCompiler_43.dll
FEB2010_X3DAudio_x64.inf
FEB2010_XACT_x64.inf
FEB2010_XAudio_x64.inf
JUN2010_D3DCompiler_43_x64.inf
JUN2010_D3DCompiler_43_x86.inf
JUN2010_XACT_x64.inf
JUN2010_XACT_x86.inf
JUN2010_XAudio_x64.inf
JUN2010_XAudio_x86.inf
JUN2010_d3dcsx_43_x64.inf
JUN2010_d3dcsx_43_x86.inf
JUN2010_d3dx10_43_x64.inf
JUN2010_d3dx10_43_x86.inf
JUN2010_d3dx11_43_x64.inf
JUN2010_d3dx11_43_x86.inf
JUN2010_d3dx9_43_x64.inf
JUN2010_d3dx9_43_x86.inf
Jun2008_X3DAudio_x64.inf
Jun2008_X3DAudio_x86.inf
Jun2008_XACT_x64.inf
Jun2008_XACT_x86.inf
Jun2008_XAudio_x64.inf
Jun2008_XAudio_x86.inf
Jun2008_d3dx10_38_x64.inf
Jun2008_d3dx10_38_x86.inf
Jun2008_d3dx9_38_x64.inf
Jun2008_d3dx9_38_x86.inf
Mar2008_X3DAudio_x64.inf
Mar2008_X3DAudio_x86.inf
Mar2008_XACT_x64.inf
Mar2008_XACT_x86.inf
Mar2008_XAudio_x64.inf
Mar2008_XAudio_x86.inf
Mar2008_d3dx10_37_x64.inf
Mar2008_d3dx10_37_x86.inf
Mar2008_d3dx9_37_x64.inf
Mar2008_d3dx9_37_x86.inf
Mar2009_X3DAudio_x64.inf
Mar2009_X3DAudio_x86.inf
Mar2009_XACT_x64.inf
Mar2009_XACT_x86.inf
Mar2009_XAudio_x64.inf
Mar2009_XAudio_x86.inf
Mar2009_d3dx10_41_x64.inf
Mar2009_d3dx10_41_x86.inf
Mar2009_d3dx9_41_x64.inf
Nov2008_X3DAudio_x64.inf
Nov2008_X3DAudio_x86.inf
Nov2008_XACT_x64.inf
Nov2008_XACT_x86.inf
Nov2008_XAudio_x64.inf
Nov2008_XAudio_x86.inf
Nov2008_d3dx10_40_x64.inf
Nov2008_d3dx10_40_x86.inf
Nov2008_d3dx9_40_x64.inf
Nov2008_d3dx9_40_x86.inf
X3DAudio1_3.dll
X3DAudio1_4.dll
X3DAudio1_5.dll
X3DAudio1_6.dll
XAPOFX1_0.dll
XAPOFX1_1.dll
XAPOFX1_2.dll
XAPOFX1_3.dll
XAPOFX1_3.dll
XAPOFX1_5.dll
XAudio2_0.dll
XAudio2_1.dll
XAudio2_2.dll
XAudio2_3.dll
XAudio2_4.dll
XAudio2_5.dll
XAudio2_7.dll
apr2005_d3dx9_25_x64.inf
apr2005_d3dx9_25_x86.inf
apr2006_d3dx9_30_x64.inf
apr2006_d3dx9_30_x86.inf
apr2006_mdx1_x86.inf
apr2006_xact_x64.inf
apr2006_xact_x86.inf
apr2006_xinput_x64.inf
apr2006_xinput_x86.inf
apr2007_d3dx10_33_x64.inf
apr2007_d3dx10_33_x86.inf
apr2007_d3dx9_33_x64.inf
apr2007_xact_x64.inf
apr2007_xact_x86.inf
apr2007_xinput_x64.inf
aug2005_d3dx9_27_x64.inf
aug2005_d3dx9_27_x86.inf
aug2006_xact_x64.inf
aug2006_xact_x86.inf
aug2006_xinput_x64.inf
aug2006_xinput_x86.inf
aug2007_d3dx10_35_x64.inf
aug2007_d3dx10_35_x86.inf
aug2007_d3dx9_35_x64.inf
aug2007_d3dx9_35_x86.inf
aug2007_xact_x64.inf
aug2007_xact_x86.inf
d3dcompiler_33.dll
d3dcompiler_34.dll
d3dcompiler_35.dll
d3dcompiler_36.dll
d3dcsx_42.dll
d3dcsx_43.dll
d3dx10.dll
d3dx10_33.dll
d3dx10_34.dll
d3dx10_35.dll
d3dx10_36.dll
d3dx10_37.dll
d3dx10_38.dll
d3dx10_39.dll
d3dx10_40.dll
d3dx10_41.dll
d3dx10_42.dll
d3dx10_43.dll
d3dx11_42.dll
d3dx11_43.dll
d3dx9_24.dll
d3dx9_25.dll
d3dx9_26.dll
d3dx9_27.dll
d3dx9_28.dll
d3dx9_29.dll
d3dx9_30.dll
d3dx9_31.dll
d3dx9_32.dll
d3dx9_34.dll
d3dx9_35.dll
d3dx9_36.dll
d3dx9_37.dll
d3dx9_38.dll
d3dx9_39.dll
d3dx9_40.dll
d3dx9_42.dll
d3dx9_43.dll
dec2005_d3dx9_28_x64.inf
dec2005_d3dx9_28_x86.inf
dec2006_d3dx10_00_x64.inf
dec2006_d3dx10_00_x86.inf
dec2006_d3dx9_32_x64.inf
dec2006_d3dx9_32_x86.inf
dec2006_xact_x64.inf
dec2006_xact_x86.inf
feb2006_d3dx9_29_x64.inf
feb2006_d3dx9_29_x86.inf
feb2006_xact_x64.inf
feb2006_xact_x86.inf
feb2007_xact_x64.inf
feb2007_xact_x86.inf
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
infinst.exe
jun2005_d3dx9_26_x64.inf
jun2005_d3dx9_26_x86.inf
jun2006_xact_x64.inf
jun2006_xact_x86.inf
jun2007_d3dx10_34_x64.inf
jun2007_d3dx10_34_x86.inf
jun2007_d3dx9_34_x64.inf
jun2007_d3dx9_34_x86.inf
jun2007_xact_x64.inf
jun2007_xact_x86.inf
mdx_1.0.2902.0_x86.inf
microsoft.directx.diagnostics.dll
microsoft.directx.direct3dx.dll
microsoft.directx.direct3dx.xml
microsoft.directx.direct3dx.xml
nov2007_d3dx10_36_x64.inf
nov2007_d3dx10_36_x86.inf
nov2007_d3dx9_36_x64.inf
nov2007_d3dx9_36_x86.inf
nov2007_x3daudio_x64.inf
nov2007_x3daudio_x86.inf
nov2007_xact_x64.inf
nov2007_xact_x86.inf
oct2006_d3dx9_31_x64.inf
oct2006_d3dx9_31_x86.inf
oct2006_xact_x64.inf
oct2006_xact_x86.inf
x3daudio1_0.dll
x3daudio1_0.dll
x3daudio1_1.dll
x3daudio1_1.dll
x3daudio1_2.dll
x3daudio1_2.dll
x3daudio1_2.dll
xactengine2_0.dll
xactengine2_1.dll
xactengine2_10.dll
xactengine2_2.dll
xactengine2_3.dll
xactengine2_4.dll
xactengine2_5.dll
xactengine2_6.dll
xactengine2_7.dll
xactengine2_8.dll
xactengine2_9.dll
xactengine3_0.dll
xactengine3_1.dll
xactengine3_2.dll
xactengine3_3.dll
xactengine3_4.dll
xactengine3_5.dll
xactengine3_7.dll
xinput1_1.dll
xinput1_2.dll
FEB2010_X3DAudio_x86.inf
FEB2010_XACT_x86.inf
FEB2010_XAudio_x86.inf
Mar2009_d3dx9_41_x86.inf
X3DAudio1_7.dll
XAPOFX1_4.dll
apr2007_d3dx9_33_x86.inf
apr2007_xinput_x86.inf
d3dx9_33.dll
d3dx9_41.dll
dxupdate.dll
dxupdate.inf
xinput1_3.dll
HFI264C.tmp.html
dxupdate.cif
dxupdate.dll
dxwsetup.cif
dd_vcredist_amd64_20260702002556.log
dd_vcredist_amd64_20260702002556_0_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260702002556_1_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260702002601.log
dd_vcredist_amd64_20260702002601_000_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260702002601_001_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260702002605_000_vcRuntimeAdditional_x64.log
dd_vcredist_amd64_20260702002605_001_vcRuntimeMinimum_x64.log
dd_vcredist_x86_20260702002554.log
dd_vcredist_x86_20260702002554_0_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20260702002554_1_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20260702002558.log
dd_vcredist_x86_20260702002558_000_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20260702002558_001_vcRuntimeMinimum_x86.log
dd_vcredist_x86_20260702002603.log
dd_vcredist_x86_20260702002603_000_vcRuntimeAdditional_x86.log
dd_vcredist_x86_20260702002603_001_vcRuntimeMinimum_x86.log
msi.txt
msi.txt
wix.txt
wix.txt
logo.png
wixstdba.dll
wixstdba.dll
license.rtf
thm.wxl
thm.xml
license.rtf
VisualCppRedist_AIO_x86_x64.exe
dotNetFx40_Full_setup.exe
oalinst.exe
xnafx40_redist.msi
DirectX.log
MSI1427.tmp
MSI2B9B.tmp
MSI31F2.tmp
MSI3983.tmp
MSI4104.tmp
MSI472C.tmp
DirectX.log
ngen.log
ngen.log
Microsoft.Xna.Framework.Game.dll
Microsoft.Xna.Framework.Graphics.dll
Microsoft.Xna.Framework.Xact.dll
Microsoft.Xna.Framework.dll
Microsoft.Xna.Framework.Avatar.dll
Microsoft.Xna.Framework.GamerServices.dll
Microsoft.Xna.Framework.Input.Touch.dll
Microsoft.Xna.Framework.Net.dll
Microsoft.Xna.Framework.Storage.dll
Microsoft.Xna.Framework.Video.dll
XAudio2_6.dll
Apr2005_d3dx9_25_x64.cab
Apr2005_d3dx9_25_x86.cab
Apr2006_d3dx9_30_x64.cab
Apr2006_d3dx9_30_x86.cab
Apr2006_xact_x64.cab
Apr2006_xact_x86.cab
Apr2006_xinput_x64.cab
Apr2006_xinput_x86.cab
Apr2007_d3dx10_33_x64.cab
Apr2007_d3dx10_33_x86.cab
Apr2007_d3dx9_33_x64.cab
Apr2007_xact_x64.cab
Apr2007_xact_x86.cab
Apr2007_xinput_x64.cab
Aug2005_d3dx9_27_x64.cab
Aug2005_d3dx9_27_x86.cab
Aug2006_xact_x64.cab
Aug2006_xinput_x86.cab
Aug2007_d3dx10_35_x64.cab
Aug2007_d3dx10_35_x86.cab
Aug2007_d3dx9_35_x64.cab
Aug2007_d3dx9_35_x86.cab
Aug2007_xact_x64.cab
Aug2007_xact_x86.cab
Aug2008_d3dx10_39_x64.cab
Aug2008_d3dx10_39_x86.cab
Aug2008_d3dx9_39_x64.cab
Aug2008_d3dx9_39_x86.cab
Aug2008_xact_x64.cab
Aug2008_xact_x86.cab
Aug2008_xaudio_x64.cab
Aug2008_xaudio_x86.cab
Aug2009_D3DCompiler_42_x64.cab
Aug2009_D3DCompiler_42_x86.cab
Aug2009_d3dcsx_42_x64.cab
Aug2009_d3dcsx_42_x86.cab
Aug2009_d3dx10_42_x64.cab
Aug2009_d3dx10_42_x86.cab
Aug2009_d3dx11_42_x64.cab
Aug2009_d3dx11_42_x86.cab
Aug2009_d3dx9_42_x64.cab
Aug2009_d3dx9_42_x86.cab
Aug2009_xact_x64.cab
Aug2009_xact_x86.cab
Aug2009_xaudio_x64.cab
Aug2009_xaudio_x86.cab
Dec2005_d3dx9_28_x64.cab
Dec2005_d3dx9_28_x86.cab
Dec2006_d3dx10_00_x64.cab
Dec2006_d3dx10_00_x86.cab
Dec2006_d3dx9_32_x64.cab
Dec2006_d3dx9_32_x86.cab
Dec2006_xact_x64.cab
Dec2006_xact_x86.cab
Feb2005_d3dx9_24_x64.cab
Feb2005_d3dx9_24_x86.cab
Feb2006_d3dx9_29_x64.cab
Feb2006_d3dx9_29_x86.cab
Feb2006_xact_x64.cab
Feb2006_xact_x86.cab
Feb2007_xact_x64.cab
Feb2007_xact_x86.cab
Feb2010_x3daudio_x64.cab
Feb2010_xact_x64.cab
Feb2010_xaudio_x64.cab
Jun2005_d3dx9_26_x64.cab
Jun2005_d3dx9_26_x86.cab
Jun2006_xact_x64.cab
Jun2007_d3dx10_34_x64.cab
Jun2007_d3dx10_34_x86.cab
Jun2007_d3dx9_34_x64.cab
Jun2007_d3dx9_34_x86.cab
Jun2007_xact_x64.cab
Jun2007_xact_x86.cab
Jun2008_d3dx10_38_x64.cab
Jun2008_d3dx10_38_x86.cab
Jun2008_d3dx9_38_x86.cab
Jun2008_x3daudio_x64.cab
Jun2008_x3daudio_x86.cab
Jun2008_xact_x64.cab
Jun2008_xact_x86.cab
Jun2008_xaudio_x64.cab
Jun2008_xaudio_x86.cab
Jun2010_D3DCompiler_43_x64.cab
Jun2010_D3DCompiler_43_x86.cab
Jun2010_d3dcsx_43_x64.cab
Jun2010_d3dcsx_43_x86.cab
Jun2010_d3dx10_43_x64.cab
Jun2010_d3dx10_43_x86.cab
Jun2010_d3dx11_43_x64.cab
Jun2010_d3dx11_43_x86.cab
Jun2010_d3dx9_43_x64.cab
Jun2010_d3dx9_43_x86.cab
Jun2010_xact_x64.cab
Jun2010_xact_x86.cab
Jun2010_xaudio_x64.cab
Jun2010_xaudio_x86.cab
MDX_1.0.2902.0_x86.cab
MDX_1.0.2903.0_x86.cab
MDX_1.0.2904.0_x86.cab
MDX_1.0.2905.0_x86.cab
MDX_1.0.2906.0_x86.cab
MDX_1.0.2907.0_x86.cab
MDX_1.0.2908.0_x86.cab
MDX_1.0.2909.0_x86.cab
MDX_1.0.2910.0_x86.cab
Mar2008_d3dx10_37_x64.cab
Mar2008_d3dx10_37_x86.cab
Mar2008_d3dx9_37_x64.cab
Mar2008_d3dx9_37_x86.cab
Mar2008_x3daudio_x64.cab
Mar2008_x3daudio_x86.cab
Mar2008_xact_x64.cab
Mar2008_xact_x86.cab
Mar2008_xaudio_x86.cab
Mar2009_d3dx10_41_x64.cab
Mar2009_d3dx10_41_x86.cab
Mar2009_d3dx9_41_x64.cab
Mar2009_x3daudio_x64.cab
Mar2009_x3daudio_x86.cab
Mar2009_xact_x64.cab
Mar2009_xact_x86.cab
Mar2009_xaudio_x64.cab
Mar2009_xaudio_x86.cab
Nov2007_d3dx10_36_x64.cab
Nov2007_d3dx10_36_x86.cab
Nov2007_d3dx9_36_x64.cab
Nov2007_d3dx9_36_x86.cab
Nov2007_x3daudio_x64.cab
Nov2007_x3daudio_x86.cab
Nov2007_xact_x64.cab
Nov2007_xact_x86.cab
Nov2008_d3dx10_40_x64.cab
Nov2008_d3dx10_40_x86.cab
Nov2008_d3dx9_40_x64.cab
Nov2008_d3dx9_40_x86.cab
Nov2008_x3daudio_x64.cab
Nov2008_x3daudio_x86.cab
Nov2008_xact_x64.cab
Nov2008_xact_x86.cab
Nov2008_xaudio_x64.cab
Nov2008_xaudio_x86.cab
Oct2006_d3dx9_31_x64.cab
Oct2006_d3dx9_31_x86.cab
Oct2006_xact_x64.cab
Oct2006_xact_x86.cab
dsetup.dll
dsetup32.dll
dxupdate.cab
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
filelist.dat
xactengine3_6.dll
SETEBA9.tmp
XAPOFX1_3.dll
x3daudio1_2.dll
OLD3B6.tmp
OLDE8EA.tmp
wixstdba.dll
license.rtf
thm.xml
Microsoft.DirectX.AudioVideoPlayback.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3DX.dll
__AssemblyInfo__.ini
Microsoft.DirectX.Direct3D.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectDraw.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectInput.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectPlay.dll
__AssemblyInfo__.ini
Microsoft.DirectX.DirectSound.dll
__AssemblyInfo__.ini
Microsoft.DirectX.dll
__AssemblyInfo__.ini
Microsoft.Office.Tools.v4.0.Framework.dll
Microsoft.Office.Tools.Outlook.dll
Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Microsoft.Office.Tools.Common.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Microsoft.Office.Tools.Excel.dll
Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Microsoft.Office.Tools.Common.Implementation.dll
Microsoft.Office.Tools.dll
Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Microsoft.Office.Tools.Word.Implementation.dll
Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Microsoft.Office.Tools.Excel.Implementation.dll
Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Microsoft.Office.Tools.Outlook.Implementation.dll
Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Microsoft.Office.Tools.Word.dll
Microsoft.VisualStudio.Tools.Office.Runtime.dll
Aug2006_xinput_x64.cab
Jun2006_xact_x86.cab
Aug2006_xact_x86.cab
Mar2008_xaudio_x64.cab
Jun2008_d3dx9_38_x64.cab
Apr2006_MDX1_x86.cab
Setup.exe
SetupEngine.dll
metadata-2
{872b93bd-5098-4e69-bec1-77bd9e029ebb}_OnDiskSnapshotProp
memory/656-3645-0x0000000000880000-0x00000000008E5000-memory.dmp
memory/796-3598-0x0000000000660000-0x00000000006D7000-memory.dmp
memory/1052-3076-0x00000000005F0000-0x0000000000655000-memory.dmp
memory/1056-3703-0x0000000000DD0000-0x0000000000E47000-memory.dmp
memory/1320-21946-0x0000000002150000-0x00000000021AE000-memory.dmp
memory/1632-3127-0x0000000000880000-0x00000000008E5000-memory.dmp
memory/1836-3184-0x0000000000E20000-0x0000000000E7E000-memory.dmp
memory/3028-3595-0x00000000005F0000-0x0000000000655000-memory.dmp
memory/3212-3594-0x00000000005F0000-0x0000000000655000-memory.dmp
memory/3300-3027-0x0000000000910000-0x000000000096E000-memory.dmp
memory/3368-3599-0x0000000000660000-0x00000000006D7000-memory.dmp
memory/3960-3077-0x00000000005F0000-0x0000000000655000-memory.dmp
memory/4064-3296-0x0000000000910000-0x000000000096E000-memory.dmp
memory/4072-3646-0x0000000000880000-0x00000000008E5000-memory.dmp
memory/4492-22135-0x00000000021E0000-0x000000000223E000-memory.dmp
memory/4504-3754-0x0000000000660000-0x00000000006D7000-memory.dmp
memory/4724-21570-0x0000000002240000-0x000000000229A000-memory.dmp
memory/4804-3297-0x0000000000910000-0x000000000096E000-memory.dmp
memory/4884-11732-0x000001CB16790000-0x000001CB167BE000-memory.dmp
memory/4884-11549-0x000001CB165F0000-0x000001CB165FC000-memory.dmp
memory/4884-11504-0x000001CB16800000-0x000001CB16818000-memory.dmp
memory/4884-11513-0x000001CB16820000-0x000001CB1683C000-memory.dmp
memory/4884-11501-0x000001CB16840000-0x000001CB16876000-memory.dmp
memory/4884-11516-0x000001CB16880000-0x000001CB16896000-memory.dmp
memory/4884-11497-0x000001CB165C0000-0x000001CB165CE000-memory.dmp
memory/4884-11519-0x000001CB165D0000-0x000001CB165D8000-memory.dmp
memory/4884-11525-0x000001CB169F0000-0x000001CB16A66000-memory.dmp
memory/4884-11494-0x000001CB167D0000-0x000001CB167FA000-memory.dmp
memory/4884-11540-0x000001CB16C60000-0x000001CB16CBE000-memory.dmp
memory/4884-11490-0x000001CB165B0000-0x000001CB165BA000-memory.dmp
memory/4884-11558-0x000001CB16C00000-0x000001CB16C28000-memory.dmp
memory/4884-11487-0x000001CB16790000-0x000001CB167C4000-memory.dmp
memory/4884-11582-0x000001CB16DA0000-0x000001CB16DB4000-memory.dmp
memory/4884-11483-0x000001CB16520000-0x000001CB1652A000-memory.dmp
memory/4884-11648-0x000001CB16790000-0x000001CB167AA000-memory.dmp
memory/4884-11697-0x000001CB167D0000-0x000001CB16806000-memory.dmp
memory/4884-11767-0x000001CB16790000-0x000001CB167B6000-memory.dmp
memory/4884-11795-0x000001CB16790000-0x000001CB167B6000-memory.dmp
memory/4884-11788-0x000001CB16800000-0x000001CB16866000-memory.dmp
memory/4884-11781-0x000001CB165B0000-0x000001CB165C6000-memory.dmp
memory/4884-11774-0x000001CB167F0000-0x000001CB16848000-memory.dmp
memory/4884-11760-0x000001CB168A0000-0x000001CB16916000-memory.dmp
memory/4884-11753-0x000001CB167F0000-0x000001CB1684C000-memory.dmp
memory/4884-11746-0x000001CB16790000-0x000001CB167B8000-memory.dmp
memory/4884-11739-0x000001CB165B0000-0x000001CB165C2000-memory.dmp
memory/4884-11725-0x000001CB165B0000-0x000001CB165CC000-memory.dmp
memory/4884-11718-0x000001CB16520000-0x000001CB16528000-memory.dmp
memory/4884-11711-0x000001CB16520000-0x000001CB1652C000-memory.dmp
memory/4884-11704-0x000001CB167D0000-0x000001CB16804000-memory.dmp
memory/4884-11690-0x000001CB165B0000-0x000001CB165C8000-memory.dmp
memory/4884-11683-0x000001CB165B0000-0x000001CB165C4000-memory.dmp
memory/4884-11676-0x000001CB165B0000-0x000001CB165C4000-memory.dmp
memory/4884-11669-0x000001CB16520000-0x000001CB1652A000-memory.dmp
memory/4884-11662-0x000001CB16790000-0x000001CB167A8000-memory.dmp
memory/4884-11655-0x000001CB16520000-0x000001CB1652E000-memory.dmp
memory/4884-11641-0x000001CB16C50000-0x000001CB16CAC000-memory.dmp
memory/4884-11634-0x000001CB16DC0000-0x000001CB16DF4000-memory.dmp
memory/4884-11627-0x000001CB16900000-0x000001CB1692A000-memory.dmp
memory/4884-11620-0x000001CB16520000-0x000001CB1652A000-memory.dmp
memory/4884-11613-0x000001CB165C0000-0x000001CB165CE000-memory.dmp
memory/4884-11606-0x000001CB165C0000-0x000001CB165CE000-memory.dmp
memory/4884-11599-0x000001CB165C0000-0x000001CB165CE000-memory.dmp
memory/4884-11578-0x000001CB16C30000-0x000001CB16C44000-memory.dmp
memory/4884-11574-0x000001CB16910000-0x000001CB1691E000-memory.dmp
memory/4884-11570-0x000001CB16900000-0x000001CB1690E000-memory.dmp
memory/4884-11555-0x000001CB16CC0000-0x000001CB16D18000-memory.dmp
memory/4884-11552-0x000001CB16B40000-0x000001CB16B5A000-memory.dmp
memory/4884-11510-0x000001CB16990000-0x000001CB169EC000-memory.dmp
memory/4884-11546-0x000001CB16AA0000-0x000001CB16AC6000-memory.dmp
memory/4884-11543-0x000001CB16D30000-0x000001CB16D96000-memory.dmp
memory/4884-11537-0x000001CB16960000-0x000001CB16972000-memory.dmp
memory/4884-1192-0x000001CB16E20000-0x000001CB16E2C000-memory.dmp
memory/4884-1213-0x0000000000860000-0x000000000090A000-memory.dmp
memory/4884-11534-0x000001CB16A70000-0x000001CB16A96000-memory.dmp
memory/4884-11531-0x000001CB165E0000-0x000001CB165EE000-memory.dmp
memory/4884-11528-0x000001CB16930000-0x000001CB1695E000-memory.dmp
memory/4884-11522-0x000001CB168A0000-0x000001CB168B8000-memory.dmp
memory/4884-1234-0x000001CB16E50000-0x000001CB16E68000-memory.dmp
memory/4884-11507-0x000001CB168C0000-0x000001CB168F4000-memory.dmp
memory/4884-1237-0x000001CB16E70000-0x000001CB16E88000-memory.dmp
memory/4884-1245-0x000001CB16E30000-0x000001CB16E3C000-memory.dmp
memory/4884-1252-0x000001CB16E40000-0x000001CB16E4C000-memory.dmp
memory/4884-1258-0x0000000000980000-0x0000000000996000-memory.dmp
memory/4884-1255-0x000001CB16E90000-0x000001CB16E9A000-memory.dmp
memory/4884-1248-0x000001CB16EB0000-0x000001CB16EC4000-memory.dmp
memory/4884-1242-0x0000000000910000-0x000000000097C000-memory.dmp
memory/4912-3596-0x0000000000660000-0x00000000006D7000-memory.dmp
memory/4920-3026-0x0000000000910000-0x000000000096E000-memory.dmp
memory/5212-3753-0x0000000000660000-0x00000000006D7000-memory.dmp
memory/5216-3126-0x0000000000880000-0x00000000008E5000-memory.dmp
memory/5456-3242-0x0000000000DD0000-0x0000000000E47000-memory.dmp
memory/5600-3702-0x0000000000DD0000-0x0000000000E47000-memory.dmp
memory/5616-3241-0x0000000000DD0000-0x0000000000E47000-memory.dmp
memory/5684-2977-0x0000000000E20000-0x0000000000E7E000-memory.dmp
memory/5692-2978-0x0000000000E20000-0x0000000000E7E000-memory.dmp
memory/6076-3239-0x0000000000DD0000-0x0000000000E47000-memory.dmp
memory/6140-3186-0x0000000000E20000-0x0000000000E7E000-memory.dmp
memory/6756-23486-0x0000000002230000-0x0000000002299000-memory.dmp
memory/8440-12951-0x000000001BE80000-0x000000001C192000-memory.dmp
memory/8440-12989-0x000000001B4C0000-0x000000001B568000-memory.dmp
memory/8440-12913-0x000000001AF70000-0x000000001AF88000-memory.dmp
memory/8440-12915-0x000000001B9B0000-0x000000001BE7E000-memory.dmp
memory/8440-12874-0x000000001AF90000-0x000000001AF9E000-memory.dmp
memory/8440-12872-0x000000001AF90000-0x000000001AF9E000-memory.dmp
memory/8440-12988-0x0000000000A20000-0x0000000000A2C000-memory.dmp
memory/8440-12977-0x0000000000A20000-0x0000000000A2C000-memory.dmp
memory/8440-12871-0x000000001AF90000-0x000000001AF9A000-memory.dmp
memory/8440-12914-0x000000001B440000-0x000000001B45A000-memory.dmp
memory/8440-12870-0x000000001AF90000-0x000000001AF9C000-memory.dmp
memory/8440-12869-0x000000001AF90000-0x000000001AF9A000-memory.dmp
memory/8440-12833-0x00000000009D0000-0x00000000009DE000-memory.dmp
memory/8440-12832-0x00000000009F0000-0x0000000000A1C000-memory.dmp
memory/8440-12899-0x000000001B420000-0x000000001B436000-memory.dmp
memory/8440-12912-0x000000001AF90000-0x000000001AF9E000-memory.dmp
memory/8440-12911-0x000000001B080000-0x000000001B08E000-memory.dmp
memory/8440-12887-0x000000001B450000-0x000000001B498000-memory.dmp
memory/9068-23872-0x0000000002000000-0x0000000002069000-memory.dmp
memory/9804-22424-0x0000000002310000-0x0000000002374000-memory.dmp