Overview

overview

8

Static

static

3

VisualCppR...64.exe

windows10-2004-x64

7

VisualCppR...64.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    34s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VisualCppRedist_AIO_x86_x64.exe
  • Size 30.1MB
  • Sample260707-msbmaags4t
  • SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\system32\reg.exe
          reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
          4⤵
            PID:2512
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ver"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5744
        • C:\Windows\system32\findstr.exe
          findstr /c:" 5."
          3⤵
            PID:5704
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ver
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1096
          • C:\Windows\system32\reg.exe
            reg.exe query "HKU\S-1-5-19"
            3⤵
              PID:5232
            • C:\Windows\system32\Wbem\WMIC.exe
              wmic path Win32_ComputerSystem get CreationClassName /value
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6004
            • C:\Windows\system32\find.exe
              find /i "ComputerSystem"
              3⤵
                PID:924
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1528
                • C:\Windows\system32\reg.exe
                  reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
                  4⤵
                    PID:4076
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3864
                  • C:\Windows\system32\reg.exe
                    reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
                    4⤵
                      PID:4120
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:940
                    • C:\Windows\system32\reg.exe
                      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
                      4⤵
                        PID:4064
                    • C:\Windows\system32\reg.exe
                      reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
                      3⤵
                        PID:1692
                      • C:\Windows\system32\find.exe
                        find /i "0x0"
                        3⤵
                          PID:3500
                        • C:\Windows\system32\reg.exe
                          reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
                          3⤵
                            PID:5248
                          • C:\Windows\system32\find.exe
                            find /i "0x0"
                            3⤵
                              PID:6124
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4316
                              • C:\Windows\system32\cscript.exe
                                cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
                                4⤵
                                  PID:3228
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c echo 0.40219.473
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:1776
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
                                3⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3116
                                • C:\Windows\system32\cscript.exe
                                  cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
                                  4⤵
                                    PID:912
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c echo 0.61135.400
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2804
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3748
                                  • C:\Windows\system32\cscript.exe
                                    cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
                                    4⤵
                                      PID:5856
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c echo 0.40664.0
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2392
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5480
                                    • C:\Windows\system32\cscript.exe
                                      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
                                      4⤵
                                        PID:2684
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c echo 50.35719.0
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5820
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5488
                                    • C:\Windows\system32\findstr.exe
                                      findstr /v /c:"0.50727.6229"
                                      3⤵
                                        PID:5692
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1276
                                      • C:\Windows\system32\findstr.exe
                                        findstr /v /c:"0.50727.6229"
                                        3⤵
                                          PID:4692
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2840
                                        • C:\Windows\system32\findstr.exe
                                          findstr /v /c:"0.30729.7523"
                                          3⤵
                                            PID:6112
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                            3⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2992
                                          • C:\Windows\system32\findstr.exe
                                            findstr /v /c:"0.30729.7523"
                                            3⤵
                                              PID:4380
                                            • C:\Windows\system32\reg.exe
                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
                                              3⤵
                                                PID:3132
                                              • C:\Windows\system32\reg.exe
                                                reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
                                                3⤵
                                                • Modifies registry key
                                                PID:5612
                                              • C:\Windows\system32\reg.exe
                                                reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
                                                3⤵
                                                • Modifies registry key
                                                PID:2096
                                              • C:\Windows\system32\find.exe
                                                find /i "VC_RED_enu_"
                                                3⤵
                                                  PID:4512
                                                • C:\Windows\system32\reg.exe
                                                  reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
                                                  3⤵
                                                  • Modifies registry key
                                                  PID:1352
                                                • C:\Windows\system32\reg.exe
                                                  reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
                                                  3⤵
                                                  • Modifies registry key
                                                  PID:4480
                                                • C:\Windows\system32\find.exe
                                                  find /i "VC_RED_enu_"
                                                  3⤵
                                                    PID:2912
                                                  • C:\Windows\system32\reg.exe
                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
                                                    3⤵
                                                    • Modifies registry key
                                                    PID:4212
                                                  • C:\Windows\system32\reg.exe
                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
                                                    3⤵
                                                      PID:2572
                                                    • C:\Windows\system32\reg.exe
                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
                                                      3⤵
                                                      • Modifies registry key
                                                      PID:5396
                                                    • C:\Windows\system32\reg.exe
                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
                                                      3⤵
                                                      • Modifies registry key
                                                      PID:5644
                                                    • C:\Windows\system32\reg.exe
                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString
                                                      3⤵
                                                      • Modifies registry key
                                                      PID:6000
                                                    • C:\Windows\system32\reg.exe
                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString
                                                      3⤵
                                                      • Modifies registry key
                                                      PID:4416
                                                    • C:\Windows\system32\reg.exe
                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
                                                      3⤵
                                                      • Modifies registry key
                                                      PID:2488
                                                    • C:\Windows\system32\find.exe
                                                      find /i "HKEY_LOCAL_MACHINE"
                                                      3⤵
                                                        PID:2880
                                                      • C:\Windows\system32\findstr.exe
                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                        3⤵
                                                          PID:5980
                                                        • C:\Windows\system32\reg.exe
                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
                                                          3⤵
                                                            PID:2664
                                                          • C:\Windows\system32\find.exe
                                                            find /i "HKEY_LOCAL_MACHINE"
                                                            3⤵
                                                              PID:5312
                                                            • C:\Windows\system32\findstr.exe
                                                              findstr /r "{.*-.*-.*-.*-.*}"
                                                              3⤵
                                                                PID:2388
                                                              • C:\Windows\system32\reg.exe
                                                                reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
                                                                3⤵
                                                                  PID:5640
                                                                • C:\Windows\system32\find.exe
                                                                  find /i "HKEY_LOCAL_MACHINE"
                                                                  3⤵
                                                                    PID:2916
                                                                  • C:\Windows\system32\findstr.exe
                                                                    findstr /r "{.*-.*-.*-.*-.*}"
                                                                    3⤵
                                                                      PID:2532
                                                                    • C:\Windows\system32\reg.exe
                                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
                                                                      3⤵
                                                                      • Modifies registry key
                                                                      PID:4708
                                                                    • C:\Windows\system32\find.exe
                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                      3⤵
                                                                        PID:4388
                                                                      • C:\Windows\system32\findstr.exe
                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                        3⤵
                                                                          PID:6036
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
                                                                          3⤵
                                                                          • Modifies registry key
                                                                          PID:1588
                                                                        • C:\Windows\system32\find.exe
                                                                          find /i "HKEY_LOCAL_MACHINE"
                                                                          3⤵
                                                                            PID:2828
                                                                          • C:\Windows\system32\findstr.exe
                                                                            findstr /r "{.*-.*-.*-.*-.*}"
                                                                            3⤵
                                                                              PID:468
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
                                                                              3⤵
                                                                                PID:2020
                                                                              • C:\Windows\system32\find.exe
                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                3⤵
                                                                                  PID:708
                                                                                • C:\Windows\system32\findstr.exe
                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                  3⤵
                                                                                    PID:5192
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
                                                                                    3⤵
                                                                                    • Modifies registry key
                                                                                    PID:860
                                                                                  • C:\Windows\system32\find.exe
                                                                                    find /i "HKEY_LOCAL_MACHINE"
                                                                                    3⤵
                                                                                      PID:5304
                                                                                    • C:\Windows\system32\findstr.exe
                                                                                      findstr /r "{.*-.*-.*-.*-.*}"
                                                                                      3⤵
                                                                                        PID:2552
                                                                                      • C:\Windows\system32\reg.exe
                                                                                        reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
                                                                                        3⤵
                                                                                          PID:3152
                                                                                        • C:\Windows\system32\find.exe
                                                                                          find /i "HKEY_LOCAL_MACHINE"
                                                                                          3⤵
                                                                                            PID:2596
                                                                                          • C:\Windows\system32\findstr.exe
                                                                                            findstr /r "{.*-.*-.*-.*-.*}"
                                                                                            3⤵
                                                                                              PID:5876
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
                                                                                              3⤵
                                                                                                PID:5772
                                                                                              • C:\Windows\system32\find.exe
                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                3⤵
                                                                                                  PID:6104
                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                  3⤵
                                                                                                    PID:5636
                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
                                                                                                    3⤵
                                                                                                      PID:3916
                                                                                                    • C:\Windows\system32\find.exe
                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                      3⤵
                                                                                                        PID:1492
                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                        3⤵
                                                                                                          PID:5760
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
                                                                                                          3⤵
                                                                                                          • Modifies registry key
                                                                                                          PID:3232
                                                                                                        • C:\Windows\system32\find.exe
                                                                                                          find /i "HKEY_LOCAL_MACHINE"
                                                                                                          3⤵
                                                                                                            PID:1488
                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                            findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                            3⤵
                                                                                                              PID:5676
                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
                                                                                                              3⤵
                                                                                                                PID:3380
                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                                3⤵
                                                                                                                  PID:2340
                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                  3⤵
                                                                                                                    PID:992
                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
                                                                                                                    3⤵
                                                                                                                      PID:5036
                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                                      3⤵
                                                                                                                        PID:4556
                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                        3⤵
                                                                                                                          PID:4048
                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
                                                                                                                          3⤵
                                                                                                                            PID:5084
                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                            find /i "HKEY_LOCAL_MACHINE"
                                                                                                                            3⤵
                                                                                                                              PID:2820
                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                              findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                              3⤵
                                                                                                                                PID:1624
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
                                                                                                                                3⤵
                                                                                                                                • Modifies registry key
                                                                                                                                PID:4836
                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                3⤵
                                                                                                                                  PID:4876
                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                  3⤵
                                                                                                                                    PID:2436
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
                                                                                                                                    3⤵
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:6040
                                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                                    find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                    3⤵
                                                                                                                                      PID:2608
                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                      findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                      3⤵
                                                                                                                                        PID:6088
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
                                                                                                                                        3⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:5340
                                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                                        find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                        3⤵
                                                                                                                                          PID:2876
                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                          findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                          3⤵
                                                                                                                                            PID:5336
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
                                                                                                                                            3⤵
                                                                                                                                            • Modifies registry key
                                                                                                                                            PID:2860
                                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                                            find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                            3⤵
                                                                                                                                              PID:456
                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                              findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                              3⤵
                                                                                                                                                PID:4936
                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
                                                                                                                                                3⤵
                                                                                                                                                • Modifies registry key
                                                                                                                                                PID:1664
                                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                3⤵
                                                                                                                                                  PID:2756
                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2028
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3812
                                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:240
                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1996
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
                                                                                                                                                          3⤵
                                                                                                                                                          • Modifies registry key
                                                                                                                                                          PID:2536
                                                                                                                                                        • C:\Windows\system32\find.exe
                                                                                                                                                          find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4948
                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                            findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2160
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies registry key
                                                                                                                                                              PID:4964
                                                                                                                                                            • C:\Windows\system32\find.exe
                                                                                                                                                              find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4224
                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2356
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:1320
                                                                                                                                                                • C:\Windows\system32\find.exe
                                                                                                                                                                  find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2652
                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                    findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5492
                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                      PID:3512
                                                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3220
                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1768
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                          PID:3452
                                                                                                                                                                        • C:\Windows\system32\find.exe
                                                                                                                                                                          find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:800
                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                            findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5900
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2712
                                                                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4640
                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2180
                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2404
                                                                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5080
                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4160
                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                          PID:4104
                                                                                                                                                                                        • C:\Windows\system32\find.exe
                                                                                                                                                                                          find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1212
                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                            findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:3496
                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                              PID:3664
                                                                                                                                                                                            • C:\Windows\system32\find.exe
                                                                                                                                                                                              find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2984
                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                  reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2200
                                                                                                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                                                                                                    find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:6052
                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                      findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5888
                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                        PID:4912
                                                                                                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                                                                                                        find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3384
                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                          findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                            • C:\Windows\system32\find.exe
                                                                                                                                                                                                              find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                  reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                • C:\Windows\system32\find.exe
                                                                                                                                                                                                                  find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                    findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2296
                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                      PID:980
                                                                                                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5732
                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                          findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:3936
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{997D9232-CCE0-4A88-AD0B-F825A1DCD937} {082BD264-25BB-4233-9C26-C103F1CFFB81} 3936
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                              PID:5904
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                            PID:5284
                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5144
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{81271A9B-9B3E-426C-B028-FB50068ECFFF} {FED37B40-5151-40F2-8AC9-21B332B869C7} 5144
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2532
                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                            reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:2428
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{A024394E-8238-4EC4-BDB1-4F719D94E212} {20F3AFD9-4807-46CC-B306-A72708701A7E} 5872
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                PID:1188
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                              PID:6088
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              PID:5204
                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{CBED66E4-4EF8-4B36-862F-F2B2BC1354AF} {0CA37498-72DC-4B05-8D02-5969B812BDCE} 5204
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                PID:2876
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                              PID:1096
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:5436
                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /uninstall /passive /norestart
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                PID:1568
                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{B5783537-7BAD-4287-B6D2-2C68068A5334} {5EC672A4-4D27-4949-9666-7A5E38910187} 1568
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                              reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4040
                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /uninstall /passive /norestart
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:5556
                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{0C9CFCCC-D549-46D2-A976-9778C9ADE240} {7525826B-F60E-4820-A7D3-4E727F6D114A} 5556
                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                    PID:1428
                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:2516
                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                      PID:3512
                                                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                      MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3516
                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                        reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4524
                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                          reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                          PID:2916
                                                                                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                          MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                            PID:800
                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5672
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4152
                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                PID:4632
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                                                                  • C:\Windows\system32\cscript.exe
                                                                                                                                                                                                                                                    cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:1624
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c echo 0.60917.0
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3772
                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                      reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                      PID:4348
                                                                                                                                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                      find /i "TRIN_TRIR_SETUP"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:1156
                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                        find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4764
                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                          findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                              • C:\Windows\system32\cscript.exe
                                                                                                                                                                                                                                                                cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:4536
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c echo 0.40219.473
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:2984
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cscript.exe
                                                                                                                                                                                                                                                                      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c echo 0.61135.400
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:2996
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4980
                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                          findstr /v /c:"0.50727.6229"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:6096
                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                              findstr /v /c:"0.50727.6229"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:828
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                  findstr /v /c:"0.30729.7523"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3188
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                      findstr /v /c:"0.30729.7523"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1264
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                        PID:4936
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5092
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                          find /i "VC_RED_enu_"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:3212
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                            PID:3532
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                            PID:240
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                            find /i "VC_RED_enu_"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5340
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:5320
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:1692
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:1356
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Modifies registry key
                                                                                                                                                                                                                                                                                              PID:3112
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:2972
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1096
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:3256
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:1276
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                          reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1056
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                            find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                              findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:4488
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                  find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:2396
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                    findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:4116
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                        find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4376
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                          findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:2408
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                              find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:5884
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:1924
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:5600
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                    find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:3516
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                      findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:2944
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:2824
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                          find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:5512
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                            findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                              reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:4544
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4884
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                    find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:988
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                      findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5784
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                        PID:5468
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                        find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5288
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                          findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5868
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                            PID:3284
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                            find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                              findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4352
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1596
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                                  find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5492
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                    findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2676
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                                        find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4584
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                          findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                            PID:5244
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                                            find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2236
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                              findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5620
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                PID:5852
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                                                find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                  findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:2372
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4420
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                                                                                                                                                                                                                                                                      find /i "HKEY_LOCAL_MACHINE"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                        findstr /r "{.*-.*-.*-.*-.*}"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3872
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                          findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                            reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                            PID:5168
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                            MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3772
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                              reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4132
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                    MsiExec.exe /X{37B8F9C7-03FB-3253-8781-2517C99D7C00} /passive /norestart
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /f
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry key
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                      MsiExec.exe /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /passive /norestart
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                        reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /f
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              c:\Windows\syswow64\MsiExec.exe -Embedding 4FF62EDE624ACDAE1B638E9AC72F8F79
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                c:\Windows\syswow64\MsiExec.exe -Embedding B74E681417937BC285BBF7CEE67AD1C5
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                • \??\c:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  c:\Windows\System32\MsiExec.exe -Embedding 7A92D552F4CFDA89679FC34FD974F2AD
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    c:\Windows\System32\MsiExec.exe -Embedding 46E49C123B1ECC91752E98BDFCE7B573
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 080E688D6E8CEC69E868B3DC909621BA
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\syswow64\MsiExec.exe -Embedding 96DAE5BF5282EA380FCFD661AEBFCFE7
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\syswow64\MsiExec.exe -Embedding 52A8FEF9442C53A9D848D323005A9FAA
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\syswow64\MsiExec.exe -Embedding 039D045345F3388EE5AA4561A949698C
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114348.log" /uninstall /passive /norestart ignored /burn.runonce
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114348.log /uninstall /passive /norestart ignored
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114348.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{FFE6F80A-57D3-4C64-92D1-F75EB6BEF39B} {645AF558-04FD-4D81-A87A-411991D2A693} 5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3132
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114353.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114353.log" -burn.unelevated BurnPipe.{9E3A3064-FA22-4A94-B72F-E34E6ADE7EAF} {36C11DD7-34B0-4966-9907-6D91761532D9} 5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2160
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707114356.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707114356.log" -burn.unelevated BurnPipe.{CA5CDABF-6C7D-435E-9E26-20B45425096C} {E255635D-CF67-4D43-BEA4-806882E49CB1} 1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 2256 -s 2000
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                sihost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3000
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4964

                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac07.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac07.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 23KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2bd1218fef8c51a2e8d313e2b5faa390e799ce96cb12f181715e5962df15eb84
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac1a.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac1a.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 cdc0b702524e204875d6a5f51eb7964a11993230536bd8593382d421a0d5cb3f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac1e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac1e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1465e1444938fce05d7d29279cc0ff6eb3333d8283102843e6e97bafb219fbac
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac2f.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac2f.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e2985f1946b9ab508cbdbf6ab03a7c707c7e3bea892808a442b2a52df6fa7b14
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac34.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac34.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 4f42a4d34cdaaff736bd4d2d19fdb9d3f40bcd1f127e395aca53032d03342e9b
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac45.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac45.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 15KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 68d9282be0c5ee7ed32e571c7fa1cd3cb61bfa45a71db07705e5ea3a6773ab2d
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac4d.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac4d.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 bb69e743623f3aa563a1f7bdbfd2d41df2d62b867e81875179ad67f8dd8b9561
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac5e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac5e.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 97d7c2b8d9008fd54b2052a4378609df351f87c2de18087537a2cdc91508cfea
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac65.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac65.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2d61d88494af893abd02c0db777f8152730ff8718b5f69cca03ae527dbfb858e
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac76.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac76.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 20KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d63848a968238be01ac880ab468f9185bf7bffb8f10e2ee17f6bf4ccdf099331
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac84.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac84.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 31KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 552f5283179d1316d09c58718b4405625af56172016a0a528149d55a0d07a41c
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ac88.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ac88.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 49KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a36d548626b3577685253e48f8436e317243ef1ed12a33e4759941af7946348f
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59acac.rbf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59acac.rbf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3B
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59acaf.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59acaf.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 31KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e418c44c1494e609d613d39c76efe43dc4f1fe16a61c70963833be11e951c942
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59acb3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59acb3.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 52KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 73fbc5150f14c860693b3d0c378ae5b2cc1bb6cece04ab1e390426c0c34347f3
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ace9.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ace9.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 41KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c8058eb2332d3ad5c74eb8c222108644ff08432b98e7416de5589f31ef570798
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59acef.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59acef.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 39b25e3170075aadcc6f85fa89c452790e37d3548c5c705a61a08d26638a38cd
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59acf2.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59acf2.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 181cbc851d9d575d6300aa42ceb7662c828aa8a201054111cbd7f0098c09a97c
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59acf6.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59acf6.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 14KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 abf33ef08689c78b7ae55db434aaa5092d70c940d079c99bfc6cf8cd3f25e6f1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59acfb.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59acfb.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 00f71439d28f2d9584310a4f7139666125febdcff39e3d8ae26399826986de53
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ad00.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ad00.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 18KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8719f9fa1c3df0d4d7e966818640bacc98a262576fc4693257943d9582f744e9
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      e59ad05.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Config.Msi\e59ad05.rbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 21KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e52b696ea2d00ccb5624125cda8b2f0f8f8e61173b642462bfcc3d9e7d9930b8
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 599B
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      vc_red.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 232KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Installer.cmd
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 2524a822d83eb2c6fd94cb986586a8f96486f3ce18041ac559475deefef406b6
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      filever.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 115B
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      ucrtbase.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 971KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      ucrtbase.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 900KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      vcrun.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 36KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft.Office.Tools.v9.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 101KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 31KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 137KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 79KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 85KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 44KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_amd64_20260707114356.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707114356.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 3f561aec46e11b777175a6c0a2b51401dfb92dd621465697f5f2b954566adf91
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_amd64_20260707114356_000_vcRuntimeAdditional_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707114356_000_vcRuntimeAdditional_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 52a82be2ba3addfdd82eb2153287b3702d217b01fdce6594c317e79fdc87ac53
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_amd64_20260707114356_001_vcRuntimeMinimum_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707114356_001_vcRuntimeMinimum_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 335c86809aa51d8edf61761b1ea73933285d0798338416501bda18cca109c791
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_amd64_20260707114407_000_vcRuntimeAdditional_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707114407_000_vcRuntimeAdditional_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f1263dcf8b45ae08749e176f5a9a68a6abf858d4ebdc8e9d023c0c20bdf4cc23
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_amd64_20260707114407_001_vcRuntimeMinimum_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260707114407_001_vcRuntimeMinimum_x64.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8c842894c1b7cf0ae54e822e032f80ed07b22326bf8ba40eeaa350b037d24479
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114348.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114348.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c5b15b475f4ec294634af678260278638cc649a37502d383c45bfb8c394654be
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114348_0_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114348_0_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 c26941813063464d602de4e8f36eed249118d6713af1f659c4ae8bd71847292a
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114348_1_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114348_1_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f7c739d193eb6054e204c5a729b1582782cef4f35fc00b2e3e44f84d33279a3b
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114353.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114353.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 7KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6fb11cc4ed990561a9081c4107956dfd83bb2a99ba522d253893e011c21f28f8
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114353_000_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114353_000_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 afdc6efc93d69298a3090eea98d7360505edd0de6c4a4f83232b7054e1dc64fa
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114353_001_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114353_001_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7adb758c022b9f6e23e48013f9df48d6a4f01b1062b5e8db23f4b3b16700c2f0
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114400_000_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114400_000_vcRuntimeAdditional_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 0de1b4e0ab8a7197c8f16eb91ba7ebfe9de0a7957de07818808de49f18c861ad
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      dd_vcredist_x86_20260707114400_001_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260707114400_001_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 751fa450066f3d3d9a75f8e3d2bd2418ffa058028ba88682a11d3f246b08407c
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      msi.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\msi.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 984B
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 62248ef42618154e8527372789879f3448709017b63993ee75d1776c7a9c8216
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      msi.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\msi.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 444B
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f5533eaab75ce285af93111f1602b45c7874c6c4eff3161aefca592e8d1d42ec
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      wix.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wix.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 492B
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      wix.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\wix.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 738B
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      logo.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 126KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 117KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 47KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      thm.wxl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\thm.wxl
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      thm.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\thm.xml
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 5KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 6KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MSI16FD.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Installer\MSI16FD.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 97KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MSI1ECB.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Installer\MSI1ECB.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 93KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MSI4CC.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Installer\MSI4CC.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 80KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      MSIFC71.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Installer\MSIFC71.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 87KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Temp\{14802ACD-E4A5-42DC-9EE5-532841D9A0D3}\.ba\wixstdba.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 191KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1188-1710-0x00000000006D0000-0x0000000000735000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1320-2111-0x0000000000F10000-0x0000000000F75000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1324-2112-0x0000000000F10000-0x0000000000F75000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/1568-2066-0x0000000000520000-0x0000000000597000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2388-2064-0x0000000000520000-0x0000000000597000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/2876-1772-0x0000000000F10000-0x0000000000F75000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-1856-0x0000027381A30000-0x0000027381A50000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-1841-0x00000273801E0000-0x00000273802E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-1887-0x0000027384310000-0x0000027384330000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-1873-0x0000027381D30000-0x0000027381D50000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-1843-0x00000273801E0000-0x00000273802E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-1842-0x00000273801E0000-0x00000273802E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3000-1857-0x0000027381F00000-0x0000027382000000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3004-1981-0x00000000006D0000-0x0000000000735000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3004-2050-0x00000000006D0000-0x0000000000735000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3132-1759-0x0000000000170000-0x00000000001CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/3936-1644-0x0000000000170000-0x00000000001CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4040-2140-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/4644-2137-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5184-1760-0x0000000000170000-0x00000000001CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5204-1773-0x0000000000F10000-0x0000000000F75000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5436-2068-0x0000000000520000-0x0000000000597000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5556-2139-0x0000000000DB0000-0x0000000000E27000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5872-1711-0x00000000006D0000-0x0000000000735000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5904-1643-0x0000000000170000-0x00000000001CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5964-2047-0x00000000006D0000-0x0000000000735000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                      memory/5964-1980-0x00000000006D0000-0x0000000000735000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                      Download