floxif | 40151642843efa321e71e92027e66210280d840779d0a0255cee20b3f734632e

Analysis

max time kernel
70s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
Size 27.7MB
Sample260712-t2lbeads8j
SHA256 40151642843efa321e71e92027e66210280d840779d0a0255cee20b3f734632e
MD5 9670481268ba23e077fe9e5cba29a30c
SHA1 29d93ad93d70b7cd12273a3440685dba3f698701
SHA512 e9809d161a51d5fda55e6b0f8056bb3e6933e562e4fe901ab4cba9427239543975b621b79230cef6c5e09c45334c728b984fd90936cacf486ba4afb43adaeee8
SSDEEP 786432:qac8dBvXKL1y/AQf9S7QFpv9VH5d2LPoWG:qadByEYQf9xFpv9d50PbG
TLSH
T1FD57330231ADBED2E87250713B73D7C9EFBCED4AA924C9CA2DE10906617D16339D17A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif persistence ransomware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000e00000001c553-1.dat	floxif

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c553-1.dat	UPX
behavioral2/memory/4764-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4764-627-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4764-628-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4764-1502-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4764-1518-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4764-2221-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001c553-1.dat	acprotect

Loads dropped DLL 64 IoCs

pid	Process
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
5964	vcredist_x86.exe
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
2736	vcredist_x64.exe
4708	vcredist_x86.exe
1516	vcredist_x64.exe
5588	vcredist_x64.exe
2700	VC_redist.x86.exe
2528	VC_redist.x64.exe
1808	vcredist_x86.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
2660	VC_redist.x86.exe
5756	MsiExec.exe
5756	MsiExec.exe
5756	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4312	VC_redist.x64.exe
4628	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
4972	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe
1148	MsiExec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\d:	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\system32\mfc100fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100chs.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c553-1.dat	upx
behavioral2/memory/4764-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4764-627-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4764-628-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4764-1502-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4764-1518-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4764-2221-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_vcomp100_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC428.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C2E.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\1699b.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9C7.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100chs_x64	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100fra_x64	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_vcomp100_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CF5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI892C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACED.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC500095B19C078E4.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5DDBDDCAE5D9E124.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2E361482D081498D.TMP	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9A7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1AAF73B57CECFDED.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6756.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100fra_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcp100_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_msvcr100_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD0D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB88A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA231.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB8F.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100jpn_x64	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCB892DF12E2C905E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB909.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF38CDCF63B7161118.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2572D2893AD08915.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF46105F155A120020.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4E2ED8CE51C0237D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA71D.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_atl100_x64	msiexec.exe
File created	C:\Windows\SystemTemp\~DF370926AAD5F4E628.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5C0.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100cht_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcr100_x64	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1E0940422EBEE199.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF129472FF7642558A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA3ED6E4B373718FF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6AD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA70D.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100chs_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100rus_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB9F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC768.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF99D25F3CE3F62D69.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF47D3A651421914FB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9EC3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC078.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF574B523F1D954D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74A7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD73EA4483F9AD3E6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACBD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0C7.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5964	2528	WerFault.exe	195

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\679E80FBE29B63345BF612177149674C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Patches	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDD54ADF71E8F6333ADE53B6B7C786A8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F603C2ED760AFE838BC630EDB430219F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1FB5F95B8C762083E895C25E153AF95C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8520DAD7C5154DD39846DB1714990E7F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v12\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B696E639D8C084A389FD43F4AEE41193	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v12	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5276	reg.exe
4752	reg.exe
5280	reg.exe
4756	reg.exe
1076	reg.exe
2736	reg.exe
1580	reg.exe
4268	reg.exe
4984	reg.exe
3884	reg.exe
5932	reg.exe
4188	reg.exe
2204	reg.exe
5580	reg.exe
2408	reg.exe
3256	reg.exe
2568	reg.exe
5780	reg.exe
4568	reg.exe
1076	reg.exe
1284	reg.exe
2244	reg.exe
4712	reg.exe
3256	reg.exe
5440	reg.exe
2388	reg.exe
3176	reg.exe
4460	reg.exe
1272	reg.exe
4272	reg.exe
3492	reg.exe
4920	reg.exe
4740	reg.exe
5984	reg.exe
632	reg.exe
3976	reg.exe
1808	reg.exe
200	reg.exe
4844	reg.exe
1580	reg.exe
2136	reg.exe
5544	reg.exe
4112	reg.exe
3060	reg.exe
4452	reg.exe
4524	reg.exe
5636	reg.exe
1008	reg.exe
1504	reg.exe
3652	reg.exe
4384	reg.exe
1132	reg.exe
2060	reg.exe
5824	reg.exe
4252	reg.exe
1408	reg.exe
1964	reg.exe
3104	reg.exe
5380	reg.exe
4796	reg.exe
1492	reg.exe
6040	reg.exe
4636	reg.exe
1132	reg.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
3348	WMIC.exe
3348	WMIC.exe
3348	WMIC.exe
3348	WMIC.exe
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe
2012	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
Token: SeIncreaseQuotaPrivilege	3348	WMIC.exe
Token: SeSecurityPrivilege	3348	WMIC.exe
Token: SeTakeOwnershipPrivilege	3348	WMIC.exe
Token: SeLoadDriverPrivilege	3348	WMIC.exe
Token: SeSystemProfilePrivilege	3348	WMIC.exe
Token: SeSystemtimePrivilege	3348	WMIC.exe
Token: SeProfSingleProcessPrivilege	3348	WMIC.exe
Token: SeIncBasePriorityPrivilege	3348	WMIC.exe
Token: SeCreatePagefilePrivilege	3348	WMIC.exe
Token: SeBackupPrivilege	3348	WMIC.exe
Token: SeRestorePrivilege	3348	WMIC.exe
Token: SeShutdownPrivilege	3348	WMIC.exe
Token: SeDebugPrivilege	3348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3348	WMIC.exe
Token: SeRemoteShutdownPrivilege	3348	WMIC.exe
Token: SeUndockPrivilege	3348	WMIC.exe
Token: SeManageVolumePrivilege	3348	WMIC.exe
Token: 33	3348	WMIC.exe
Token: 34	3348	WMIC.exe
Token: 35	3348	WMIC.exe
Token: 36	3348	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3348	WMIC.exe
Token: SeSecurityPrivilege	3348	WMIC.exe
Token: SeTakeOwnershipPrivilege	3348	WMIC.exe
Token: SeLoadDriverPrivilege	3348	WMIC.exe
Token: SeSystemProfilePrivilege	3348	WMIC.exe
Token: SeSystemtimePrivilege	3348	WMIC.exe
Token: SeProfSingleProcessPrivilege	3348	WMIC.exe
Token: SeIncBasePriorityPrivilege	3348	WMIC.exe
Token: SeCreatePagefilePrivilege	3348	WMIC.exe
Token: SeBackupPrivilege	3348	WMIC.exe
Token: SeRestorePrivilege	3348	WMIC.exe
Token: SeShutdownPrivilege	3348	WMIC.exe
Token: SeDebugPrivilege	3348	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3348	WMIC.exe
Token: SeRemoteShutdownPrivilege	3348	WMIC.exe
Token: SeUndockPrivilege	3348	WMIC.exe
Token: SeManageVolumePrivilege	3348	WMIC.exe
Token: 33	3348	WMIC.exe
Token: 34	3348	WMIC.exe
Token: 35	3348	WMIC.exe
Token: 36	3348	WMIC.exe
Token: SeBackupPrivilege	2600	vssvc.exe
Token: SeRestorePrivilege	2600	vssvc.exe
Token: SeAuditPrivilege	2600	vssvc.exe
Token: SeBackupPrivilege	5624	srtasks.exe
Token: SeRestorePrivilege	5624	srtasks.exe
Token: SeSecurityPrivilege	5624	srtasks.exe
Token: SeTakeOwnershipPrivilege	5624	srtasks.exe
Token: SeShutdownPrivilege	2096	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	2096	vcredist_x86.exe
Token: SeSecurityPrivilege	2012	msiexec.exe
Token: SeCreateTokenPrivilege	2096	vcredist_x86.exe
Token: SeAssignPrimaryTokenPrivilege	2096	vcredist_x86.exe
Token: SeLockMemoryPrivilege	2096	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	2096	vcredist_x86.exe
Token: SeMachineAccountPrivilege	2096	vcredist_x86.exe
Token: SeTcbPrivilege	2096	vcredist_x86.exe
Token: SeSecurityPrivilege	2096	vcredist_x86.exe
Token: SeTakeOwnershipPrivilege	2096	vcredist_x86.exe
Token: SeLoadDriverPrivilege	2096	vcredist_x86.exe
Token: SeSystemProfilePrivilege	2096	vcredist_x86.exe
Token: SeSystemtimePrivilege	2096	vcredist_x86.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
5964	vcredist_x86.exe
2736	vcredist_x64.exe
4708	vcredist_x86.exe
1516	vcredist_x64.exe
2700	VC_redist.x86.exe
2528	VC_redist.x64.exe
1808	vcredist_x86.exe
3912	msiexec.exe
2660	VC_redist.x86.exe
3912	msiexec.exe
2736	msiexec.exe
4312	VC_redist.x64.exe
2736	msiexec.exe
1396	msiexec.exe
1396	msiexec.exe
4600	msiexec.exe
4600	msiexec.exe
5476	msiexec.exe
5476	msiexec.exe
6080	msiexec.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2012	msiexec.exe
3912	msiexec.exe
5756	MsiExec.exe
2736	msiexec.exe
4628	MsiExec.exe
1396	msiexec.exe
4972	MsiExec.exe
4600	msiexec.exe
1148	MsiExec.exe
5476	msiexec.exe
1128	MsiExec.exe
6080	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4300	4764	2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe	88
PID 4300 wrote to memory of 5104	4300	cmd.exe	90
PID 5104 wrote to memory of 200	5104	cmd.exe	91
PID 4300 wrote to memory of 4088	4300	cmd.exe	92
PID 4300 wrote to memory of 2276	4300	cmd.exe	93
PID 4300 wrote to memory of 4864	4300	cmd.exe	94
PID 4300 wrote to memory of 1156	4300	cmd.exe	95
PID 4300 wrote to memory of 3348	4300	cmd.exe	96
PID 4300 wrote to memory of 4140	4300	cmd.exe	97
PID 4300 wrote to memory of 2168	4300	cmd.exe	99
PID 2168 wrote to memory of 4244	2168	cmd.exe	100
PID 4300 wrote to memory of 4128	4300	cmd.exe	101
PID 4128 wrote to memory of 5892	4128	cmd.exe	102
PID 4300 wrote to memory of 2120	4300	cmd.exe	103
PID 2120 wrote to memory of 1596	2120	cmd.exe	104
PID 4300 wrote to memory of 3064	4300	cmd.exe	105
PID 4300 wrote to memory of 3680	4300	cmd.exe	106
PID 4300 wrote to memory of 3048	4300	cmd.exe	107
PID 4300 wrote to memory of 5444	4300	cmd.exe	108
PID 4300 wrote to memory of 4984	4300	cmd.exe	109
PID 4300 wrote to memory of 2096	4300	cmd.exe	110
PID 4300 wrote to memory of 1152	4300	cmd.exe	111
PID 4300 wrote to memory of 5824	4300	cmd.exe	112
PID 4300 wrote to memory of 248	4300	cmd.exe	113
PID 4300 wrote to memory of 4628	4300	cmd.exe	114
PID 4300 wrote to memory of 1504	4300	cmd.exe	115
PID 4300 wrote to memory of 2560	4300	cmd.exe	116
PID 4300 wrote to memory of 4120	4300	cmd.exe	117
PID 4300 wrote to memory of 4636	4300	cmd.exe	118
PID 4300 wrote to memory of 1524	4300	cmd.exe	119
PID 4300 wrote to memory of 5744	4300	cmd.exe	120
PID 4300 wrote to memory of 3884	4300	cmd.exe	121
PID 4300 wrote to memory of 4880	4300	cmd.exe	122
PID 4300 wrote to memory of 3244	4300	cmd.exe	123
PID 4300 wrote to memory of 1284	4300	cmd.exe	124
PID 4300 wrote to memory of 6108	4300	cmd.exe	125
PID 4300 wrote to memory of 836	4300	cmd.exe	126
PID 4300 wrote to memory of 632	4300	cmd.exe	127
PID 4300 wrote to memory of 916	4300	cmd.exe	128
PID 4300 wrote to memory of 928	4300	cmd.exe	129
PID 4300 wrote to memory of 1076	4300	cmd.exe	130
PID 4300 wrote to memory of 3800	4300	cmd.exe	131
PID 4300 wrote to memory of 1592	4300	cmd.exe	132
PID 4300 wrote to memory of 5932	4300	cmd.exe	133
PID 4300 wrote to memory of 5328	4300	cmd.exe	134
PID 4300 wrote to memory of 2808	4300	cmd.exe	135
PID 4300 wrote to memory of 3976	4300	cmd.exe	136
PID 4300 wrote to memory of 3500	4300	cmd.exe	137
PID 4300 wrote to memory of 4500	4300	cmd.exe	138
PID 4300 wrote to memory of 4740	4300	cmd.exe	139
PID 4300 wrote to memory of 3928	4300	cmd.exe	140
PID 4300 wrote to memory of 4856	4300	cmd.exe	141
PID 4300 wrote to memory of 4524	4300	cmd.exe	142
PID 4300 wrote to memory of 5136	4300	cmd.exe	143
PID 4300 wrote to memory of 5540	4300	cmd.exe	144
PID 4300 wrote to memory of 3652	4300	cmd.exe	145
PID 4300 wrote to memory of 1616	4300	cmd.exe	146
PID 4300 wrote to memory of 3368	4300	cmd.exe	147
PID 4300 wrote to memory of 4188	4300	cmd.exe	148
PID 4300 wrote to memory of 1192	4300	cmd.exe	149
PID 4300 wrote to memory of 3664	4300	cmd.exe	150
PID 4300 wrote to memory of 3256	4300	cmd.exe	151
PID 4300 wrote to memory of 4780	4300	cmd.exe	152
PID 4300 wrote to memory of 3796	4300	cmd.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_9670481268ba23e077fe9e5cba29a30c_elex_floxif_wannacry.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4088
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
- - C:\Windows\system32\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    PID:1156
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:5892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:1596
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:3064
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:3680
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:3048
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:5444
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4984
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2096
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1152
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5824
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:248
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4628
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1504
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2560
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4120
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4636
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1524
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5744
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3884
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4880
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3244
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1284
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:6108
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:836
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:632
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:916
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:928
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1076
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3800
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1592
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5932
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5328
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2808
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3976
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3500
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4500
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4740
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3928
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4856
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4524
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5136
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5540
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3652
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1616
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3368
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4188
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1192
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3664
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3256
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4780
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3796
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:1244
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{80F75077-B0A7-4C11-AC17-6CD8B7CCC165} {CE9D1630-154C-4DF4-A167-98A867EFB05D} 4904
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5964
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    - Modifies registry key
    PID:2204
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{061944D3-476B-4542-BDE2-8B2F4D7CD85A} {78549144-CB2C-4D22-86A3-974C8EBB9107} 4104
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2736
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:1132
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{A29E1DEE-872B-4278-BA48-81A0BF0D7629} {87452867-D630-4C28-9169-08F9DD26CFB9} 2096
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4708
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    - Modifies registry key
    PID:2568
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5540
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{2A050D6D-C2F7-42C2-A492-6B6A70A793B7} {FCFAF25C-BFEE-462F-B4FF-FA35B67F5826} 5540
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1516
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    PID:3232
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2700
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0CDDAACC-0FE2-4E78-9C15-85AF2AED6F53} {09544BB4-249D-4E21-B8BC-DCF5912E6F7F} 2700
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4376
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:2244
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2528
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DF64AABE-81C3-402A-9C18-47812739CA3A} {B821E7BA-2D3D-4933-A365-538883D22C43} 2528
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 1312
        5⤵
        Program crash
        
        PID:5964
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    - Modifies registry key
    PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      PID:852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      PID:3200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2704
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      PID:5716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 40.33810.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4384
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2352
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:572
- - C:\Windows\system32\findstr.exe
    findstr /i /v {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
    3⤵
    PID:3040
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2736
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1016
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1140
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1132
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4628
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:248
- - C:\Windows\system32\findstr.exe
    findstr /i /v {9BE518E6-ECC6-35A9-88E4-87755C07200F}
    3⤵
    PID:1364
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4844
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2628
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4120
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4460
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5380
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1252
- - C:\Windows\system32\findstr.exe
    findstr /i /v {F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
    3⤵
    PID:5212
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4712
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1568
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3080
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5276
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4860
- - C:\Windows\system32\findstr.exe
    findstr /i /v {B175520C-86A2-35A7-8619-86DC379688B9}
    3⤵
    PID:2424
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4796
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1904
- - C:\Windows\system32\findstr.exe
    findstr /i /v {BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
    3⤵
    PID:356
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1272
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2636
- - C:\Windows\system32\findstr.exe
    findstr /i /v {D401961D-3A20-3AC7-943B-6139D5BD490A}
    3⤵
    PID:4972
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:5580
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5348
- - C:\Windows\system32\findstr.exe
    findstr /i /v {8122DAB1-ED4D-3676-BB0A-CA368196543E}
    3⤵
    PID:3976
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5636
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3696
- - C:\Windows\system32\findstr.exe
    findstr /i /v {5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}
    3⤵
    PID:1064
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4272
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:764
- - C:\Windows\system32\findstr.exe
    findstr /i /v {0C3457A0-3DCE-4A33-BEF0-9B528C557771}
    3⤵
    PID:3652
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1492
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5040
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1408
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5260
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5780
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5712
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1008
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2680
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4752
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2968
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    PID:3880
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1516
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1580
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5688
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3256
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2580
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:3792
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3912
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    - Modifies registry key
    PID:6040
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2736
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    - Modifies registry key
    PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      PID:5780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
      4⤵
      PID:6092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp120.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp120.dll"
      4⤵
      PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4176
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1580
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5688
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1208
- - C:\Windows\system32\findstr.exe
    findstr /i /v {ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}
    3⤵
    PID:4280
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1964
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2256
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3108
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2388
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5744
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4392
- - C:\Windows\system32\findstr.exe
    findstr /i /v {5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
    3⤵
    PID:3700
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3104
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:6124
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:124
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3176
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:800
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3232
- - C:\Windows\system32\findstr.exe
    findstr /i /v {1D8E6291-B0D5-35EC-8441-6616F567A0F7}
    3⤵
    PID:4232
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5440
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4408
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2180
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2060
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5820
- - C:\Windows\system32\findstr.exe
    findstr /i /v {37B8F9C7-03FB-3253-8781-2517C99D7C00}
    3⤵
    PID:1668
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:5280
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:6100
- - C:\Windows\system32\findstr.exe
    findstr /i /v {CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
    3⤵
    PID:4724
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5984
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5716
- - C:\Windows\system32\findstr.exe
    findstr /i /v {010792BA-551A-3AC0-A7EF-0FAB4156C382}
    3⤵
    PID:3760
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2136
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2352
- - C:\Windows\system32\findstr.exe
    findstr /i /v {53CF6934-A98D-3D84-9146-FC4EDF3D5641}
    3⤵
    PID:3972
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5544
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5616
- - C:\Windows\system32\findstr.exe
    findstr /i /v {59CED48F-EBFE-480C-8A38-FC079C2BEC0F}
    3⤵
    PID:3036
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4112
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1736
- - C:\Windows\system32\findstr.exe
    findstr /i /v {B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}
    3⤵
    PID:2688
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1808
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1592
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4268
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4476
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4568
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5816
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3492
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2820
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5380
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4460
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4756
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5012
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3060
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2244
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1076
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1996
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:632
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1396
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:4452
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4600
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    PID:1504
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5740BD44-B58D-321A-AFC0-6D3D4556DD6C} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5476
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C} /f
    3⤵
    - Modifies registry key
    PID:4920
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{CB0836EC-B072-368D-82B2-D3470BF95707} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:6080
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707} /f
    3⤵
    - Modifies registry key
    PID:200
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    PID:5592
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    PID:4636
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:4080
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:5712
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    PID:4660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:3892

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2012
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 49F8CF58C0A808EE1402BA1335DCE6AC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5756
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 0AF2694462AD92ABBB3FEE3F27ECAEDF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4628
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding CDC94F01198EBF1B573A2F3B189FBE81
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4972
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 2014ADF85FCC573C5653F77D1A417908
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BDEA68F26EABCB863FDE8B1E01CBE628
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1128
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A85D887CB12208542924E39F680B99D0
  2⤵
  PID:4840
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B35BCD3A6C95A4B5C8907079ABBA9A5A
  2⤵
  PID:1816
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2584DCE39A349C6CB0D105AA20FB290E
  2⤵
  PID:4860
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D9833A914EE4AAFD83AF5B6929DFA4AA
  2⤵
  PID:4616
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DF46C1B5AAB081E9B651A5524D26425F M Global\MSI0000
  2⤵
  PID:124
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8B4B861DAAB312E73321CBBB7B790D40 E Global\MSI0000
  2⤵
  PID:2516
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    PID:1128
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:2136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CBD2E58733FA52B22C1EC16F1CC3EEF3 E Global\MSI0000
  2⤵
  PID:2628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4604
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1496
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5932
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2128
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4112
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2660
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:120
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3508
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3500
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:8
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1364
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:6120
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4108
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1500
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1192
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5476
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1340
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5716
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3136
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2620
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4536
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4448
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1252
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5836
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4812
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5616
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2696
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2408
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5912
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4524
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5992
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3652
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4208
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4796
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4668
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:6100
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2756
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2352
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4920
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:252
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1504
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3032
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4856
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4324
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:704
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4376
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2740
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1712
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4660
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:6008
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4672
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1396
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4452
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:3444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:5820
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 362D8DA35F884E29D5632AF4EE929A8E
  2⤵
  PID:3376

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:5108
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173406.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5132
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173406.log" -burn.unelevated BurnPipe.{421C9A16-4F1A-43B4-8CD6-838214204FBF} {F790088E-937E-44D4-93FC-1876604C5295} 5132
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1808

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:5728
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5880
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" -burn.unelevated BurnPipe.{9DB25C23-201A-4AEF-901D-3FE3BD55D077} {88D7E915-3590-4737-B720-698545BA773A} 5880
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5588

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:4332
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173412.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5700
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173412.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2660

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:600
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260712173415.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260712173415.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4312
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1C928198-A531-4235-BE74-77A5885E1D50} {3EB91415-D0AC-416E-9856-0BEF07730DFB} 4312
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2528 -ip 2528
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a669d.rbs

Path C:\Config.Msi\e5a669d.rbs
Size 21KB
SHA256 3319ccb1382dcb354fc9932c42bacbbab9fdd2df97c3586986f92572832455e8
MD5 af0164f973aeabebcd815bc0402f67ef
SHA1 129f18d2fe6d93bb54cba68692617713a428b660
SHA512 5cadbe270e007f2e86e35dad7e487de88906ce0e75f4715fc0f1dd8fd1844dc6ae1c6be13987f8e293025507ca59347639c45dd797287d837d8258927c4d3bcf
SSDEEP 384:xeRPWRhwe5esSOMX3Mq8KywUhT2dHnMbXq3tCDI0pB:xOeCe5erOMX3Mq8Kt6T2dHnMbXq3tCDt
TLSH
T104A2DB03B640D2E3D8672B30DD6B1B657B76C7E99311839B00EC92344E977C62F9A58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a66ae.rbs

Path C:\Config.Msi\e5a66ae.rbs
Size 14KB
SHA256 7d9ab2785ff030e499e1aaafad71eeb84458a1351ed62c092a3308a6652f55d8
MD5 6fbf1da3a91bd5275cc94a50cdd0acb9
SHA1 839dc15d4fbb3486472809c0b06544982dae92e8
SHA512 fb276e678497da615e530092393e4d63a05abdd330f1db500e527cedea7a2af652411ccb961daf7f8d95688b1ed1e1358d67350bfa6456c777c73c2081aaa655
SSDEEP 96:xMNp48xNpM0l7ztH8RieDwYx12tH8RqeDwYCj71rR7c7QNpx1FNpLxcNpkFaxcTp:x3RCYbR6YYaqbzfCgPo6/WMfl
TLSH
T1A852F103AB0586C7DDA62B30CA231B247B73C7EE9354835B21DDD1748E577862E8D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a66b5.rbs

Path C:\Config.Msi\e5a66b5.rbs
Size 20KB
SHA256 b001242c965a2e4c858474486791e4c1488b84abac50182bab02fe81c41ea0f1
MD5 38c8867e4b3ab1cd92e44373ac8c4a82
SHA1 9df434f589c3922f5d6f9530ff575909bb6f34bd
SHA512 08c6f7d510a79748acf945fe9cd9fd6b60e091a62517682f4f2e9268fb32856550100d5f410632b96788acf4d682c90812e91f83f00c871c6f7150f208e1c3c5
SSDEEP 384:DIRcglRGgFfXMawmn28I1S9HXVZFbLQPOK0OT2eBS2nWRMHdft:DscgGifXMawmn28IA9HXVZFbkPOK0C2I
TLSH
T10BA2FE03A644D5E3D8B62B70DD671BA57B32CBE59361434B40EC95388F933C22E9968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a66c6.rbs

Path C:\Config.Msi\e5a66c6.rbs
Size 17KB
SHA256 a5dc8bc2d5e48d169828f3075549b2a634cba7d8a582e7b0c8709e5783ec59aa
MD5 98c684b19fae545882909978a1b2aea6
SHA1 0c92125e4e12c42687977c557678a893e9fb5225
SHA512 59388228c3ac44f304cc9c275bfe6daa298a76d42f9e94d4f1303d0e844e68617640272512958335379f7612c6cb6652259f799f224ad2b3ffeb6c9ebb39540c
SSDEEP 96:yeRp55Rp/NPWT8RweDd11xQo8R4eDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3TjF:yWR/1GRn1Hn4Xyin5f7e+nh18X0mAry
TLSH
T1E982ED42A94096D3E8662B70DD571B7037B7C7E5A344839B40EC92349F87BD22F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a66cd.rbs

Path C:\Config.Msi\e5a66cd.rbs
Size 21KB
SHA256 f2cc2a52033834eb112089e847199a534cbcfcbac9a7ec3873ded751f8cf9fc9
MD5 6432b85bd7b6575df359582ec8b24df7
SHA1 974c0294ec5ce4f789939376986bdae92b3465a8
SHA512 cd600683d3656a6ba1c8526b0f0a1d85dd349de589df3283bb7ad3e2466e2bca38bef927d91d19fa5da8072b87b9fd7ec966f7ddf31f4134e016b077df0df289
SSDEEP 384:CgRfGRAnAKxNAUhUC7xJjrMNYPzIbSfP8EziyJmrsTxkP:CUOwAKhkmK
TLSH
T168A2FE43768099E3C86227B1DD671BA53B72E7D99350434710ACD1388F633C72F5AA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a66de.rbs

Path C:\Config.Msi\e5a66de.rbs
Size 20KB
SHA256 e785718c8f72e1f4f2308554c243d1634464c2e414ceccf5526738380b4161e1
MD5 b72e3a3fe84efffaa1796b0d0e28400c
SHA1 9be9e32e94644dc101bb6b1610d4306546adf2ec
SHA512 13e8c35aa138c9bb50ceaf70026ab9f1116176a6edf77050e04d147113b4a6fe0dfb7dbf0e06e0fd40629c2c48195ab2529f946504046c912bdf1593791e5862
SSDEEP 192:vaRY1kRx15dXcFUADIc1f+W+y4+oAkgCzCYL7:vaRY6RxTeC81f/cqkT7
TLSH
T11192EC42A680C9E3D8766B31CD635B653B76DBD9A350438B40DC90308F93BCA2F9D69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a66ec.rbs

Path C:\Config.Msi\e5a66ec.rbs
Size 31KB
SHA256 c5ad5e6a07564067d5057a258fa69f97cdf1eb0a52b8fee9c32250bfce801fd7
MD5 8162bd62e8ca99b2e8f176ee21b1ff94
SHA1 11e4fec098acd9825426e30322c2836512c88476
SHA512 314e1bcd7e77bbfa9364023404fdf285749cfd42d942d8b8a02eea4f53c88b7818a58ca57f5c589d6e4a31a457bb5201027eb36ec521db8e288fad4a9f75b91f
SSDEEP 384:2W8N8NRneRlTu8iu84u8XcAlRTMV/ZawBV3yFgmkDRu+Ru2S:2OOdsWVvRIVxDe6DRu+RuJ
TLSH
T15AE25402F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a66f0.rbs

Path C:\Config.Msi\e5a66f0.rbs
Size 49KB
SHA256 fa1f4ddf1c15788a2f73332b107eb320ff6a45d3691338e7e7610fe5d8eae488
MD5 930f211c97af1675221b9d17a6ec07b5
SHA1 11c615e0b3802203aa8a55bd4c5c00cad80e057c
SHA512 905a07061d9cd7e14cabac8cb82228774f42a0c8bdf35cf8c594dcf633aa702611cb90c9f8986cc2062b7c2e6b98de4dff21c04cd77dedb1571a0bcd9f3ab729
SSDEEP 768:qG9YWVQKRy2Rs2iOD0MMGrLxBg3JfWW23+cqlRnLSvpFys:TJ7iq
TLSH
T1B133EF063344D6D3D6662A30CD030BB57F3BC3A69312866B54ADC1788FA7BC62E85E5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6714.rbf

Path C:\Config.Msi\e5a6714.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5a6717.rbs

Path C:\Config.Msi\e5a6717.rbs
Size 31KB
SHA256 88df3831a420d21cca3fcfb0db4bd688d469efa1d717e909c6c749902b66a651
MD5 447e1601899495ece4edc245e9467ade
SHA1 a0a2977bd0990753e4eb3f932a59903d82e9f52b
SHA512 15d168bacacb22fafc5194af3189890b08bcddfb6a0f8ace8454015aea7b05712af5419f63dbab9629748ece4f85a6e138509f5e4e485f8be58b0a493bc26bc0
SSDEEP 768:IiNnR0EYuxy1SQBDBsAE6HRzY1WY3BYBYFY7YYYpYGlxlQrnr:K1SG
TLSH
T1FFE28207F316E6D2E9493F74C5032B6CBB97D796830E064F44EDC8A00E66BC66A5538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a671b.rbs

Path C:\Config.Msi\e5a671b.rbs
Size 52KB
SHA256 efd15f127473a09cae9d600805d8d6542bcf0956a65ebe228e43c9c414297cc1
MD5 dd547f60e78dbdb64cd4b33889a4986a
SHA1 1e7200bb7ded60b4b076687f2f44cf9eb6f38ff8
SHA512 3de7f055d498728d6d10ab802fd5e9e5a20be751ea49cd660669d68a9488d22a1cd5d64d3430acf7d6d07aed372e5768efbb6db510cc38e33c1f4ac41c0e08f9
SSDEEP 384:GlUXRVLRat9I69m4Z9qjSZvPrwtFpCndsTfjUEulJGw8fR0KO1R0xJ9ZR0OBR0D2:G4X6t9qM7k6Ef32zRe
TLSH
T10B3362023680D0D2D56927B2F82B0B95BB36DB965722029FC1DDD53C8E673C66E8CE4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6742.rbs

Path C:\Config.Msi\e5a6742.rbs
Size 22KB
SHA256 44ce7b7d1d74346d7d8e028c25f3dde8acd350f7cf6ee1bf6adb3946bd489656
MD5 3e4d3bc167a61f26d54ce3c507eb8f69
SHA1 48cffea5f01f0dcc5a66ed721bae276c6f5e1a9b
SHA512 eb0a864d9c5b42f2d2995f67bd2b1c999b5012209a5851090657b379621f6f8730aee2d341ac1116f5ba16bea4d02933ac9d10a3ffb1eb7c0ebd540f5406890b
SSDEEP 384:6HRORR7NUZUGz5YkrcZqbogvXDHD8x4g/9onoAK7:6xOmo
TLSH
T13CA2CB026640C5E3C86B2B30EDA71B693B32D7D59394878B40DD90748EA73D72F5DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6760.rbs

Path C:\Config.Msi\e5a6760.rbs
Size 41KB
SHA256 9522511ca0679ba14b5ca8d51f4f6f0ccc26202cd55f29654ce5235c8261bbb6
MD5 64a12e97194c4d93307f5f76fb2d50e6
SHA1 f25c7cb6471e39e6bb519167fac1b88817a4a980
SHA512 a8c375e614abe316596c69145b84791446bfff60d0b2f347a439f67ed34f78c68136a9981f29c58df35d3e1eb24dd810f409161442d5afcac4fe004ae6ff9c3d
SSDEEP 768:2QyMuCg21kTx9/DoflxL1JcEY8wNSCNfTDvj45:ByMuCg21kTx9/DoflxL1JcEYj1g
TLSH
T1221351027900C0C3E5762BB1EC2F17847376D6E79B21439F85CEA5349E873CA5E89E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6766.rbs

Path C:\Config.Msi\e5a6766.rbs
Size 3KB
SHA256 1ec2b7577442245ed5c4834287cf56e9b1ffa66182b0e1ac4be97eb5aed46e98
MD5 991147cf7eceb10b54a50066ca1a5bd9
SHA1 c8c5fb49b9b0dce8c7111fbb76a3fd8e2afb4e4d
SHA512 0891d11c4cac27e4ee48df585e921fe9e912729d8230a788dfa5a3c7f80c2a80f9c7f0c08f47ce287d4c07e5dcec7785267dd3f675a524268a5c961e3b83e59b
TLSH
T18181AE43DA44D2C6DCAA6B30CD571B2037B3D3DAC7648387158C91708E4BBD5AFEA58A
MD5 SHA1 SHA512 TLSH

Submit Download

e5a6769.rbs

Path C:\Config.Msi\e5a6769.rbs
Size 3KB
SHA256 0724e4eff5740608e01de016943b71f39a88923d1692f0095d9339d4b695bee2
MD5 b0984a9d0cad83100d8ff34de946fa62
SHA1 22034ee34b807f05d078008e41f829dfe5daf8c3
SHA512 6ca6dc7ad09593ac3a198ee7bd2b5a67d7081201be81abc50e3959ff5e3966d31625000961db5499a518d9bf2fb2e425aabad89d51ead34dd095362d5aeb35ab
TLSH
T186818C03964893D6DCE6BB30CD571B143377D6DAD7648387008C91700E477DAAFEA68A
MD5 SHA1 SHA512 TLSH

Submit Download

e5a676d.rbs

Path C:\Config.Msi\e5a676d.rbs
Size 17KB
SHA256 ce72f8f22cc1ac15f4fad706be34936afaf0904b6acca5ae36f6ba89d4815b77
MD5 b44530132f79bc72ee124ef817fa8ccf
SHA1 1b83fc53bf5a9f88ef19e8e14d95a5ed45a4e4ce
SHA512 b83354d0bf6fe93bc4db5e69498b0af4383324c43e6973dd951aeda8c7bb6f1dbdde0ffdb601b22f539260d103aaece3af7a8ee5f529ceb6f03582baca7a0643
SSDEEP 192:cyJXuj2IYcwSe8MOPDS0lS5Rt2Cj1fAkI4fAkdnFEXENNepeF:cytuj2IYcw6MOPDERnYoYa5
TLSH
T18C8233426610D2E3E8AB2B34DE171B283B75D7DAD391A34B44CD90344F937CA6F9864E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6776.rbs

Path C:\Config.Msi\e5a6776.rbs
Size 13KB
SHA256 54bae817f8434adf9ebafc37993eacd883d0a6773a6ffc3d56c28f8c2c096686
MD5 d4f51227e41e75c381199e46f604ae3e
SHA1 9d28ce2438df5d357131fe5cdf599f42a771daf8
SHA512 6f0c11e16593f2afb7923663998b5ddfd1c4f5d61f54f49b2f3ee68366c692fe1b93f6e38d6504f22ebf334ed233d1dc9dd2b0ee9647c33480cabf20bc20ca66
SSDEEP 384:RFYRS3X27/M5JjZNx6Y/pSuQ7fpqPfdd/v:RmF4v
TLSH
T15C5210423B2681E2D8271730C64B1BA93F6AC7D19324834B059D9A344F977CE7ECC98E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6777.rbf

Path C:\Config.Msi\e5a6777.rbf
Size 644KB
SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
MD5 edef53778eaafe476ee523be5c2ab67f
SHA1 58c416508913045f99cdf559f31e71f88626f6de
SHA512 7fc931c69aca6a09924c84f57a4a2bcf506859ab02f622d858e9e13d5917c5d3bdd475ba88f7a7e537bdae84ca3df9c3a7c56b2b0ca3c2d463bd7e9b905e2ef8
SSDEEP 12288:EOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvX71A+2EKZm+GWodEEpvYG:jAtvsIvL2EKZm+GWodEEpvYG
TLSH
T158E45B13FB150AB0E192D37891D78741D7F1BC898822F30752ABE27D5F67391AA2B361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6778.rbf

Path C:\Config.Msi\e5a6778.rbf
Size 940KB
SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
MD5 aeb29ccc27e16c4fd223a00189b44524
SHA1 45a6671c64f353c79c0060bdafea0ceb5ad889be
SHA512 2ec4d768a07cfa19d7a30cbd1a94d97ba4f296194b9c725cef8e50a2078e9e593a460e4296e033a05b191dc863acf6879d50c2242e82fe00054ca1952628e006
SSDEEP 24576:cj7dDxvo5outISmDa5HSueghIHkCvf44lmWymt:cnLLSl1tCX44h
TLSH
T1CE25BE4576A106F9D473D2B4CA679647F2B2B85A0530DB6F02E08A6D3F23B30966F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6779.rbf

Path C:\Config.Msi\e5a6779.rbf
Size 470KB
SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
MD5 f0ec8a3ddf8e0534983a05a52bce8924
SHA1 5f6d0265273f00ffe8e30cf507f0d05d330ff296
SHA512 d7b084d7f20de29ff16341df2756861bb7ac22eab0711869b3e77a84d841fb76a898d7459ca1be62eed522caa1f022c891a7d30c94bf0fff1bb4d016be8aa9bb
SSDEEP 6144:iU03ZYl14gzlZrGo2QgeapeUQdUyyO9tIUosLAV2SAD17pFHVhDnnV0tOA6Y1qkZ:i+G6gS7hAV2SGn3I1qkZ
TLSH
T1E8A43B19FA5C8C61D063923E84EBD6C6F3B234585F32DB4B6159933D2F77A90AD2C221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a677a.rbf

Path C:\Config.Msi\e5a677a.rbf
Size 348KB
SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
MD5 ea1e99dec990691d41f938085f68bcc7
SHA1 5fdcbcd777e10e765d593994dc66f930c1377b0e
SHA512 e90a40bd8e20bbca3c6188a78ad75578e51d88aa638e0bbfed4f6f6efdd0917e92b08ef4b0ccc2dee08774f08658b189e25234270e8ce1ca60a7e0ec8e3fbcf8
SSDEEP 6144:eg5dgFfqaKFJyHrBye4/RAHq0KzO9OAgfVgYCDlicdY:eOdc4/RAHqkeX0icm
TLSH
T18E741A127BA88CE3D43391764AA78B45E7B2B8920F71E30B2594432E5F773616C1F672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a677b.rbf

Path C:\Config.Msi\e5a677b.rbf
Size 134KB
SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
MD5 d7dbc7c92177837431ae2fd7fb569e2c
SHA1 c26140204a6db421842ad36599326a5369fd1b5d
SHA512 4f2b197ea912b5ea1a82ac84e1c15ca8e3787460cd79a32733ea920dcf3b1db5cf0507ad7c94f4e4ccab9dfc6773a9d05a8eeaa7bd7c61b63d780b69ed7ae0d8
SSDEEP 3072:2cjMv1qzORu8kLSiHHUswXIhEXniHJfshjcsdQoLqUi25/+MWRATg/TKEfB6:MqnTSiUswDnipy1dQoFqA8/H6
TLSH
T195D36C4B32E4007BE5A79630CD638D59D776BC5706709B4E07A402EE1F233E6AE29736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6780.rbs

Path C:\Config.Msi\e5a6780.rbs
Size 21KB
SHA256 5c73c329ce8e5d31e87a711aa0382a9d97a9a72b504c33a12029151b36675c2e
MD5 f4e2c1175d308b2a4dc6b2c098f31c2c
SHA1 c6c7d7659f4a64128433621677c61e5f7e796608
SHA512 d9d97fb9a3bd15a628d9d36fb3dd05faadb11e6fcf8947449ede554c278608c2bf41aaee9fcc689eda92ac48152d8b48448e6816badc2306341c0f32264b2f7a
SSDEEP 384:7MT8MgXEtmrnb0MM0IE+AfCuS588UkRy040B5XDcpq:7MT8MgXEtmrnb0MM0IA5UF
TLSH
T151A2ED42A640D6C3D8A76B30DE5B1B653735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6785.rbs

Path C:\Config.Msi\e5a6785.rbs
Size 18KB
SHA256 ad0c1944be8befe28d41695b8e8af32f1b4256591a6097a5fd02aadb11b492ba
MD5 ea1fcd927aeb0c3d3c92049c9ba81ec0
SHA1 eb83f8777e4a9b3ee133bcc634d03f689c52f660
SHA512 af4f01e3ab569b5a9d9f1ed0b5ab43a6c3ec4d6e91fbdbf07e4a2ef750f9bce52e302f811fb8ab40aa678e5663fa261e71773552c22145d1c3abccbdc3ad1433
SSDEEP 192:7ODG+fVvI+qFDw1WNR/FuQrCrPO/IqO/jP7E99fMuRF5bpk:7IG+fVvIrFDw1WNRwO1OUMuR6
TLSH
T1C792FC01BA4485E3D8A62770CD8757243B7AD7EEA351534B01CD91304FE77CA6FAA38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a678a.rbs

Path C:\Config.Msi\e5a678a.rbs
Size 21KB
SHA256 f625f54a9a6e4e0987e5f0fc9b9f8d5db06dcc7481c3e9e91b99c5ebb4d87630
MD5 552b3c9900df0b63cca9def0ec044f25
SHA1 844d13455f08be25eb63efa455a31fbed136d956
SHA512 53eb444e73add9cbd9ce40b428d1f7d3fcbdf97ed5fac25c736d520fe6acff59cde992d0beae62d51b2b5911cdd7b95751c2084a478a054fde685833c3736fc2
SSDEEP 384:wlBiqbjuPTdpTAyjI40JLIsalckU72eC6DTvhUhUcI3kLsq:wlBiqbjuPTdpTAy8hJLtT5gzI32sq
TLSH
T1D3A20E43A604D693C8AB2B71CD572B55333AC3DAA3A5434B06CC91704F837CB1F9E69A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a678f.rbs

Path C:\Config.Msi\e5a678f.rbs
Size 1.1MB
SHA256 7d894622eaf3a93f3c09c6e2d77d8a964f6522d4c1a3714860025fa9366e2ef6
MD5 d2e1abd810c80b695ae53c919886972b
SHA1 5f7d37fc773d593e431312515fe40bbf478b332b
SHA512 412849e4abe75117cda5fb517fa7b02a09999450949ebf888c866846446510896a99dc7f4ac811a06302932f3382ed60d5049a87f4947513476dd1a108d9e67a
SSDEEP 24576:9Bcage3eVbfVhwXDpUpPIhwXDpUpPChwXDpUpPthwXDpUpP3:ZuVRhwNUxIhwNUxChwNUxthwNUx3
TLSH
T1D935074173E44175E5F7AA34D9F24A16BB73B8525B34D3CF0254862D0E72BC0AE7AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6790.rbf

Path C:\Config.Msi\e5a6790.rbf
Size 44KB
SHA256 b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e
MD5 bc959a160882b0de0583047b1b5b93a6
SHA1 78bda837a0fcc25623b54e95f3eff76c3bd79332
SHA512 7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd
SSDEEP 384:sA4dzYZj6Tt3jmpuXkGtrfK76lNWg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+7n3n:sHK6TtMGgpFiJi3SYDw
TLSH
T11013541C97E70712F2B34A719AF150C24ABEBD03BEE6E77F9B45030944616884992FF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6791.rbf

Path C:\Config.Msi\e5a6791.rbf
Size 41KB
SHA256 4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806
MD5 91ceea551937cb5da627f33ef7995ee8
SHA1 4e7483605c4027381e4796345f0a0e6aa9342a5b
SHA512 2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9
SSDEEP 384:XKBk39BmxOVst4SCtrpuXYa1pbr/0K7yKKJ9Yu6dnPU3SERztmCJMadMardz/Jiq:XKGfZs5CZqljU6rqnuqzeEfViIF
TLSH
T1FC13B529D3F84712D2F74BB16CF1A4835936FA539EB8DB5C149A530A48133D84E62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6792.rbf

Path C:\Config.Msi\e5a6792.rbf
Size 76KB
SHA256 972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867
MD5 7173d17aa9ff4cda07fbfff21a584a67
SHA1 37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc
SHA512 b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167
SSDEEP 768:MTcr9yq2UX/RPLYyODdyoSNjSvYomC+L8XW/FuhyINGLTGnBEPzfsTKJzePDFiJg:9dVV8XW/FipNGfGBEPz0ceceimOU
TLSH
T1AD7385189BFD0722F2B30B71EEB684C15E7FBE277912D61F5508414E2491FA488E2B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6793.rbf

Path C:\Config.Msi\e5a6793.rbf
Size 35KB
SHA256 06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39
MD5 da7787ae5278031ef79441d29599dcff
SHA1 4e2a4c70035808dd8bffaeb6ded8fe2980566e0f
SHA512 2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e
SSDEEP 384:neght+fMtSM9jmxa1CFbfKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3hW8zNWZQ:egX+EtkqR6rqnGHKoVijm
TLSH
T181F29529D7F84712E2F347B1ACF684836976FA13AE78DB5C14C6534948137844A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6794.rbf

Path C:\Config.Msi\e5a6794.rbf
Size 35KB
SHA256 b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa
MD5 86a1d818b679edbe94ab51b963ba79a1
SHA1 2b9ee6b54aa2f709442e7e514335e2548c933318
SHA512 ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9
SSDEEP 384:6kQOJrYa7mdessomj5R/yeizfa19xrwKJ9Yu6dnPU3SERztmCJMadMardz/JikPg:tQOVYoxVUqzD6rqnz7AWpLrFVieG
TLSH
T1E2F2C628C3FC8326EAB34B70E9F594876937F513AE76C7AC1499530D08227944523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6795.rbf

Path C:\Config.Msi\e5a6795.rbf
Size 21KB
SHA256 0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956
MD5 6083b2909a6c1ab52ce84da1b435e7cf
SHA1 e851ccddf1fcb0c2fd9cfb4a357f72633452f240
SHA512 53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1
SSDEEP 384:WK2RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYW:TurKjgEnGEFiJrvPA
TLSH
T1C6A22628D3F85721F2F34B70ADF284839973B913AE79D76D2586030D0866A449963F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6796.rbf

Path C:\Config.Msi\e5a6796.rbf
Size 24KB
SHA256 4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb
MD5 d87310699e3baac5ecc0f64673fe3485
SHA1 34460b0eb74977b98d9d3e683d5ffa2aec11059c
SHA512 096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38
SSDEEP 384:CZp0wdaXOa1FOKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81LUWIYj3gWUXRm05:Cz0Ka+qb6rqnDnOVi+t+8
TLSH
T152B22428D3F85312E2F38BB1DDF58487A976BA53AE35C79C2596134D08227844963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6797.rbf

Path C:\Config.Msi\e5a6797.rbf
Size 280KB
SHA256 a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b
MD5 a3ae8e892e025e479978fb07fb449784
SHA1 71a1641ffb0da859af5e355c5bf4a9bcf1746e74
SHA512 e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54
SSDEEP 6144:Z/0op4WYV7/m3o5777376V7777U77aPsNKIXaXce7mNTp8HWwR/JBMm0CthHvd:+777376V7777U77aPMKIXaXce7mNTp8Z
TLSH
T19A54F8A6A2E84F22D3FE037920F1554B09F1EC17D64EFB4B684082F56C1B7A09A63D57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6798.rbf

Path C:\Config.Msi\e5a6798.rbf
Size 108KB
SHA256 6e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6
MD5 1c8e5ef9f86430fbda800e45c0a89aa5
SHA1 4e18ee249a208dbf7d7b52d412fa0d402fd3ff2a
SHA512 721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66
SSDEEP 1536:64OjG3HW1g/e6TLw8PW/quND/OOw6XSq/KGTEEFBtU+IN7cqKQns:6rjoi6vdu0Ow6tKGfU+IN93s
TLSH
T1D2B31A1093FC4721E6F70BB57DF6A0418673F9229EA3D31D1959060E1826F948EA2B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a6799.rbf

Path C:\Config.Msi\e5a6799.rbf
Size 152KB
SHA256 a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036
MD5 6742f826c21773c933fc2a68ceecb99b
SHA1 dc689d3fb31e7cab6a33cd2192d6114542173514
SHA512 4138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a
SSDEEP 3072:Z0anyn/CiBk6HOIz42IJqFF/0/WAWwerjeVPt:Hn+Va4k
TLSH
T12CE3295A63EC0716F6FB0731A8FA54416EBAF8032966CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a679a.rbf

Path C:\Config.Msi\e5a679a.rbf
Size 140KB
SHA256 35cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a
MD5 cad14a2ced4a556139097c1f716eae70
SHA1 9552115b645c17165bacc2231725b3f8073105a3
SHA512 df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331
SSDEEP 3072:wAyIIXB6eUAnH0gUYwlIVkGw5Ll0k+5bcj:wrIMFRuf
TLSH
T1FAE3281963E81B1BF2F70734E8FB00824BBAB9077967D71F694E41CE05A1B844662B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a679b.rbf

Path C:\Config.Msi\e5a679b.rbf
Size 189KB
SHA256 f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57
MD5 1f50737bb92b1f71b15824a0f113d3f9
SHA1 4d78793ea921986d011a024b91ac59d6c02de6e0
SHA512 89e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4
SSDEEP 3072:Lcs+QnXsia21rUBJeImxRGluQriZy+GZ7X/kMIJo:LcsrRIHiYYK
TLSH
T1CA14192467FC1B11F2FB4B7AEDB5A0019A76FE662D13D31D15A0419E1872B40CAB2B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a679c.rbf

Path C:\Config.Msi\e5a679c.rbf
Size 76KB
SHA256 dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361
MD5 d68368708be2b6dac797743e23dbf655
SHA1 e843b858d72359ecf6fcdfca328ed19a7f23210b
SHA512 2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e
SSDEEP 768:nI/327083Js1D8z1bKta9mqfVD20avQwiubnW2yCzT/8yA:nI/320UJsbta0qhRwfLyCzj8yA
TLSH
T17973F700BBBD4BA9D1FA0B7AA8B990109471FE557813CA1E0E94B14E54F2F90CEB1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a679d.rbf

Path C:\Config.Msi\e5a679d.rbf
Size 428KB
SHA256 13f36534cf603cd722ac9078e51930cba190395d23d6688b65a8c788262759e5
MD5 9e877ffed2e2c9a013c59581f88786b5
SHA1 d3bbb3e2c36520ec267463916d3356bf4fcd8037
SHA512 5b4ff6de141bf2dc321dfa05fe8c93f64ca91eae6b41041264736c3c6db9d0520c135103873c5f32a47c742fb51317b3303e7656cd259331113f9b876ad17613
SSDEEP 6144:7Nu/UTUZ5+Io0NuaoBR1KGc89rBEXkKNymKfgkLkzArpMaK0I33I+p89GP5AWMJP:Zu/UT4HQ+hpxK1/
TLSH
T1CE94E71023A88E2ACECB0275E45BC6158674DB0A76ADEF5F5DF5E2AC2CC27924D43173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a679e.rbf

Path C:\Config.Msi\e5a679e.rbf
Size 292KB
SHA256 d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c
MD5 bc9a83d77cae33f9eb9bd538ab65b2a1
SHA1 363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8
SHA512 37ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57
SSDEEP 6144:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvwCzD5OnOB3Uxo9GdwFCRcfgc9/w7GvAfM:2/3++m0QBrwOMPL8R60SxaS7Qa9CngvZ
TLSH
T18B54F816277C4A2FDA6B0674F5B2067106B9EB077392EB6F9961C2AC1EC37408D03677
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a679f.rbf

Path C:\Config.Msi\e5a679f.rbf
Size 128KB
SHA256 c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef
MD5 c7fc5f01de9577403a1ea8aafad79e72
SHA1 6422fa355184394ace02c0ba88e5b8af3db7fa6c
SHA512 b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87
SSDEEP 3072:HEmV8EKUaX1IrJeE+6pwluGCulHxTqo+Ue:HEm5azUaxW
TLSH
T126D31A01B7FD372AF2FB0B79A9F96001C97AFC556A26D78D1851424E04B5F808A72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a0.rbf

Path C:\Config.Msi\e5a67a0.rbf
Size 92KB
SHA256 6e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5
MD5 535d9d8441e0e22aa3f407c7197f8a0f
SHA1 ec6d047e975c107a7ecdf78bf352a5a68f53392f
SHA512 f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e
SSDEEP 1536:KJr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016:KJi6vPUL7zxwXmh8Gf99XZ
TLSH
T1CA93E82493FC4F61E6F71B742DF6A1814A72F9625EA2DB1F102D410E1D23B948972B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a1.rbf

Path C:\Config.Msi\e5a67a1.rbf
Size 356KB
SHA256 8186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090
MD5 5e1a793d9615d4d9e153ee416abc83ad
SHA1 27d231f4d1e2b473f9695daa21b22804db779826
SHA512 f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876
SSDEEP 3072:JBijFKiOKL/u3RW1NvAbugFh/jLqthte2Seh6GVa5DU91Tp01sq9kAaCXrmRKHpH:jIZrvgQKA91TnAa+tPvH
TLSH
T1B774C62073F95208E6B70B30AC7651C51A77BE67BE15C62F2449324D6A72B938B23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a2.rbf

Path C:\Config.Msi\e5a67a2.rbf
Size 352KB
SHA256 8da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296
MD5 03898441f5d9a8809c04fe746fd498b3
SHA1 35cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6
SHA512 dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12
SSDEEP 3072:DAUe9MSVBYRApDFen6PZhls5unXIYAH+OguqlRUGl0bbuMe37LfZ+QT/xK6ur6Ex:DAikDFsY3IYU+uojT/xK6ur6EaPef
TLSH
T1D174C624A6F95B65E2E70730ECF904D6D676BE03BF2AD34F1512610E1871B819A63F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a3.rbf

Path C:\Config.Msi\e5a67a3.rbf
Size 82KB
SHA256 33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a
MD5 f148286b321ed09c2d17e9e3637c807b
SHA1 b0928429f52028b512dad9c7e0996ee7ade315d3
SHA512 d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b
SSDEEP 1536:mkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79WShdMUVV:mk3gCbzexZG0YUBXfqidZhdM4V
TLSH
T155836B17A3EC4B13D3F64630A8F09A03AA71FAC37566D79B30466769089B3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a4.rbf

Path C:\Config.Msi\e5a67a4.rbf
Size 41KB
SHA256 27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db
MD5 e3c8239a97601bb203b9e9037eed89c2
SHA1 75f0e5f417477d4c491e8ad81f498faf761618a1
SHA512 71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2
SSDEEP 768:Jc1JB9Xaefxf2ZquXoQGaHQ6rqnig3qTVi:O1JHXtp+ZquHHwig6TV
TLSH
T1FC13D72493F80323E6F347B09DF194839A37B953AE25DB9D1099574D0812BC5CE62F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a5.rbf

Path C:\Config.Msi\e5a67a5.rbf
Size 76KB
SHA256 e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457
MD5 219c69df0c23fdaf84e4c9ea2835a628
SHA1 d3b091bfcaa8506d299cb1d7453fdce7fb27dafe
SHA512 e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8
SSDEEP 1536:SdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHN2gxyVu8:4YR63P8dlNGu1IcT7TXLqbgx69
TLSH
T1B373291193F88327C6FE43B564F0A8125FB9F653BEB6E71D0885939A48537C08D52B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a6.rbf

Path C:\Config.Msi\e5a67a6.rbf
Size 80KB
SHA256 5a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d
MD5 75e8bc00ad7da1e7628f146dc33cc83a
SHA1 b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e
SHA512 b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3
SSDEEP 1536:4Uy56bAm4HNNN5AU+QO2TFvKe/elIQcmEtli/G//ZgUKtmOo:Iu4HNNNmdy9EUIG/qlY1
TLSH
T1B8831A1993EA4B13D2FA0B7898F154C24BBAF5037DB6E72F9A46124E04933C44962F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a7.rbf

Path C:\Config.Msi\e5a67a7.rbf
Size 48KB
SHA256 e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f
MD5 775dac5f81248b14182c82013672c42e
SHA1 cef7bba712b25da04f60f597cb614c7e4b87f24e
SHA512 2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c
SSDEEP 384:Qeg/3V8jOAfSr7CgWzwL4/7y24p4kwo6972IbL8J717lw2Ghr49gpWg67KGhJSxl:V6l8HKAMs/+24E7r8LVGUFiJzFDQ
TLSH
T15323321C9BE75323F1B64A71EEF145C24EBDB803B9A6A73FDB451608089368844D2F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a8.rbf

Path C:\Config.Msi\e5a67a8.rbf
Size 24KB
SHA256 db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236
MD5 2a9b706d83be29f32a28f29be397e533
SHA1 31135de80dd7b7c4a27516806fbbb13d871548d9
SHA512 cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64
SSDEEP 384:w3K6a/IZa1nKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CmWbzpWZDzDm0GftpB/:w33qA6rqnLPAVip
TLSH
T1ABB20428D3F85312E2B38BB09DF5C487A977BA53AE39D79C1496134D08267C44963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67a9.rbf

Path C:\Config.Msi\e5a67a9.rbf
Size 36KB
SHA256 f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b
MD5 bd3e2c28c647533a057b5cdf8bff2c5f
SHA1 d36c80e460c5dde615ab1c268bd89309225ecb82
SHA512 14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc
SSDEEP 384:NQK7QQZbXvJ5qCmIG7g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+G6reVxW8H7W:JbxjG7FiJH6a1
TLSH
T103F2AF1C8AE70652F1B24F70DAF140C25EBEBC137DA6676FDB4607090C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67aa.rbf

Path C:\Config.Msi\e5a67aa.rbf
Size 52KB
SHA256 9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4
MD5 63a1e9cde10490008ba7ef47a12179d1
SHA1 5299af182b7cf08f95fcb3815149d7c54e73187d
SHA512 dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe
SSDEEP 1536:oy8H8QhPyUv8whq+927kgF1fGguNnJKIZ6:fZT1fGfnJrU
TLSH
T10F33C81897EA4722D3F70B7198F245C24EB5F803BA77E79F0A4853491C52B848D92B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67ab.rbf

Path C:\Config.Msi\e5a67ab.rbf
Size 36KB
SHA256 19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b
MD5 7a016cec8851a57b2f0376ae6d1fc837
SHA1 f161f9d8d7b073c1f17f55719c37124969bd7d2a
SHA512 f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456
SSDEEP 384:Q5Qndl5IG9g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+GwE/778UWj3CW:eG9FiJHF/cJ
TLSH
T187F2BC1C8AE70752F1B24B70DAF140C25EBDBD13BDA6A76FDB4507080C65A488D92FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67ac.rbf

Path C:\Config.Msi\e5a67ac.rbf
Size 64KB
SHA256 0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7
MD5 4d4774a30da56119888490cdf3157b09
SHA1 360221725daa9b7a14460fe6939d54b2173fb8d1
SHA512 eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130
SSDEEP 1536:9pvk2mCtNGNMGfRfESSgOX55uKG/SmawWQie:XkEGfR8SSgOX55uKG/SmaTE
TLSH
T10353B508C3AD8322E3F607316DF186825E71F5437A39EFBE0946375508AB7C46562BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67ad.rbf

Path C:\Config.Msi\e5a67ad.rbf
Size 62KB
SHA256 c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1
MD5 9002a577c07ab2b99979435cd8b67acd
SHA1 5b3c6231c113b726ddd55fd8a8e3ae84b1526820
SHA512 f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47
SSDEEP 768:mdgc7HHzMKqYyb6FZZ3JEMTt924zM8X79qZI336rqnbsWraHngVinE2:fc7HHzMKpyGZ3Jr249XJqZqtbkAVQR
TLSH
T1E2530814D3F88723C2FB87B568F148839A76F743ADB9DB5C1486532A04577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67ae.rbf

Path C:\Config.Msi\e5a67ae.rbf
Size 61KB
SHA256 241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec
MD5 218e31b07c6e07633a84f0248730e220
SHA1 47ee36529b741f3d52c487e6dad151f516c2eb5a
SHA512 e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0
SSDEEP 1536:ran8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsNjNPBDWGVb:NMPG7wqhDW+b
TLSH
T151532918D3F84323D6FF87B8B9F195435A36F843AE62CBAD188A538905533D44913B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67af.rbf

Path C:\Config.Msi\e5a67af.rbf
Size 81KB
SHA256 ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650
MD5 93030b5af327ece3ddc3518410e1af59
SHA1 4be27729a906169d2afcf025e10f308fce35056c
SHA512 247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d
SSDEEP 768:PVQ+jyq2UX/RPLYyODdyoSNjSvYomC+L8XW/By/g6I+wVtB4dmg1ZqnBEPzmhK7x:S4VV8XW/Og9NCJ7qBEPzmW2yZAW7KVg
TLSH
T1E6830955C7FC4726D6B74B70F9F78446A633F967AE23C78D1408824E2851BA484E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b0.rbf

Path C:\Config.Msi\e5a67b0.rbf
Size 200KB
SHA256 ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8
MD5 c30dfa5fbf9f2e6d18ceb7108923fdfc
SHA1 523c4b9043cd6d722c01215f64173b9287623d76
SHA512 075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2
SSDEEP 3072:20ZVVxFlfJ57iPki4i14IBkb2/Demjzk27wxqWSDsKnFp6/M/CP15rFJgStL+L:t5Pu4M4IulbK3C6
TLSH
T1D0144B1663FC4726F6BB0B35D8FB11026E7AF9172967DB1C2889068E0971B809973737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b1.rbf

Path C:\Config.Msi\e5a67b1.rbf
Size 197KB
SHA256 19e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501
MD5 fca2f9f00de26d0b5af4881836d6337a
SHA1 b11dcad7c00c2c85354b131c796ae34bbbefdb38
SHA512 7fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738
SSDEEP 3072:/rFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirW+Y/43zNFk1C:/rFAoOXcHfIfiA+/
TLSH
T100142A14A7FD1B25F2FB4F79EDF6A0018A36FA262D23D71D15A0015E1876B40CA62B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b2.rbf

Path C:\Config.Msi\e5a67b2.rbf
Size 27KB
SHA256 db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57
MD5 aa8ef0154efa83de1c2786ab1cb76f37
SHA1 5e4fcdf55c34538dfdda172a985731019f74898f
SHA512 17d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd
SSDEEP 384:eZPbNawkFSvPSN4J3DztyJbDr3Zcv+qLrVAtJCl9F1WijgW1Qim0GftpBjF9ZE:eHaVFSvPSNEtyJvrpcB9qi/bfVizTE
TLSH
T170D21A00C7FC536BE9A70A717DE59981493BFF52AD23E21F4068C05E14E9BF48A66723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b3.rbf

Path C:\Config.Msi\e5a67b3.rbf
Size 15KB
SHA256 1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099
MD5 62faa6fe395c5810fe4fceffcba62966
SHA1 ed830d3d1156c3a5ea6502148f4347af0c4a8051
SHA512 4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54
SSDEEP 384:21LtwmrH+mFqmwW/zwWUQim0GftpBj6XY:21lFpGfViWY
TLSH
T1D572F905D3EF8EA3DC825D319DF187827A3CE7834D62DB2B4159D16A2C633E8C961B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b4.rbf

Path C:\Config.Msi\e5a67b4.rbf
Size 90KB
SHA256 ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9
MD5 facce237d5cc5e89d8e92a36289f588b
SHA1 5b91fe97781b107df2754a5d38807a597f1d99a2
SHA512 f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0
SSDEEP 768:F+nOfOpzCJztUjm2ElyGv/NIvS1SHhodPxAoiStZp4uXhblMB/e8CKMduoUZKP4d:yy+zGztUjm2oNIv5oiIZZz8C2D4RRVZO
TLSH
T15993F626E23684BDDCC9003C75983531A73CF3B78256A78719097DAA4DD3B8BC987B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b5.rbf

Path C:\Config.Msi\e5a67b5.rbf
Size 168KB
SHA256 1246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879
MD5 d2d2a9e08ad2df5d73ca0aa0797cd96a
SHA1 f6050bc38d27c805daa078383506b93c5dd854c7
SHA512 197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de
SSDEEP 3072:fWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vam7xBAZiruL2b:fnMr8CSQ09ap6Jy65Rm2vp
TLSH
T1CCF309C1AB0BE061DC89563C38AA7F056F3CFBD295D2AB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b6.rbf

Path C:\Config.Msi\e5a67b6.rbf
Size 55KB
SHA256 89885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55
MD5 158f96bd130a9f3a1f7e91dc611e8b7d
SHA1 207264f61e8d8cd77c7dd82e7c8c38927bcdef85
SHA512 6ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a
SSDEEP 768:+RXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24hbxocNAwkEGjhl2BOBaBnD/sxFsNTl:ZSk2HQq9D2bPeVqv
TLSH
T19043A342D21A96D6CC55A5342A70FB52E63EF3FB1BE1B65F8813CCF408A3250E945F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b7.rbf

Path C:\Config.Msi\e5a67b7.rbf
Size 139KB
SHA256 38f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5
MD5 32f2ac5f45b93b733cab1865affd588d
SHA1 5062e6d2a8c1e06e19c9f0b29164915286ece618
SHA512 8384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1
SSDEEP 3072:DrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO++rCo9D5:DrwBZWkge7Dur/n
TLSH
T1FDD33A91EA35C259CE84C47D3E21BB00DB3CF3D644C2AB9F4526FCE84A8B791C552E96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b8.rbf

Path C:\Config.Msi\e5a67b8.rbf
Size 351KB
SHA256 55758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e
MD5 18a9dd94b5112ea94f3fc9fc22ff8409
SHA1 97a0b82343ef1599e517946a2c3c259b61e53ca7
SHA512 7bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6
SSDEEP 6144:ENeM8oM6s8alZ+afj5OADOQ4pUE9wstZY:49QZ3j5JOQ4pUE9wst6
TLSH
T10274A415A3FE5761E2F30B34ACB40489DAB6FD479E6A974F2445A15E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67b9.rbf

Path C:\Config.Msi\e5a67b9.rbf
Size 456KB
SHA256 a5a600ca8a60a0af629047ef8b227feba5221c5697f820da69e274f40869a6cc
MD5 54c12705dc6a32282762bbc4252e2b9b
SHA1 2d1fd38b5f3db7c7f0d7baee446a00099a506d50
SHA512 c4d96a8d8064ef917ddb98532360a8bf318535b310f908a384c0ca140ed058f5f3f24f34c3992da4399386f546381cbb1eef5432b3ff2b7c19e0491dec8d4aaf
SSDEEP 6144:I6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNic8iV:I6jwRSvQh42RNjN6YV
TLSH
T124A42B12C279D33EC2AE833754A226155BA5B2EFBAF1EF53A013C5E82C537C09D41A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67ba.rbf

Path C:\Config.Msi\e5a67ba.rbf
Size 137KB
SHA256 7acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83
MD5 9f735917c0bba0f42b40e719047eefd5
SHA1 d8c1ef036b9d841db86ffc76d9150064ee836cce
SHA512 65522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e
SSDEEP 1536:I2jLPfRUqxc0O/t4DErSu9e7EMaggaqRgDPRpTCWFVmI:I2fPJUqxy14DEF9e7D3gaqRKPDrfmI
TLSH
T120D30A00A3AA0B92D06155351FF2B942E63DFBA76AD5E75F5421CED80CB3B90CC22B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67bb.rbf

Path C:\Config.Msi\e5a67bb.rbf
Size 334KB
SHA256 7150db5b3af392a250b79f1078c87848a08b6c13448943d5a0478c2d37645b85
MD5 4b15c6de8b0cbeb6d4d7d6e14b9ca7fa
SHA1 af3b589712be828302778a6e248ebd659fcdabfe
SHA512 1f68f55cb4c32d0abf929b3382d9b773369f376853912829299c6386648c39807c6242eba037bb3988ebecd0e8b7197c91583243154c569bef1f70d0d958c491
SSDEEP 3072:700ASicZpLom0Wy0iwsC+KHIVKbHWuFvUOLKZXXZF6jJfIMRFxtZYg7eyXgMly3C:jlRAWy0iDCyVMvUYKZ+JICHNyPOB9Y81
TLSH
T193741B154268C32BD5E8C235BDB136124BBDF293BEF39B2B612695A81CC37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67bc.rbf

Path C:\Config.Msi\e5a67bc.rbf
Size 75KB
SHA256 b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929
MD5 683fc126a13b915b3ff36735ea5ca5fc
SHA1 d1ccfdf78919f51b09fbde02c2cf0f332601bd74
SHA512 4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9
SSDEEP 1536:3skby0ayhkM+TeVCB5+G9cTvdQc1bqMsDvbmOpajgNiNYV64:3DbyihcwqHpa8N4864
TLSH
T1E073F718D7FA4FB3C2AA4378ACF1424256B5F402AB52CB6B18855F841D73B94CD13B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67bd.rbf

Path C:\Config.Msi\e5a67bd.rbf
Size 389KB
SHA256 878566ee8a41806ee9b9c4cf590e1953881dde2127616a647fa31940a5096cc5
MD5 1a063e60707636e76e61ad9784bb1eea
SHA1 baf498bac402a29b1330fcd20cfbacbc5d245cf7
SHA512 39e2bcd04f4ee4e6280b7723a628acfbceef254fbea62833a34d7f4cba566c9556bfcfe2424ada027112a8b722da8349331ca416d00d0e3d6afbec96e3d91a65
SSDEEP 3072:2dxlMI0R4F60aGf0TX1zvAPuiFvVTLqtdte2Seh6mNfkGVq1XRQq7q9kAaKrVm29:nFva9GVq1XpAa+TcGR
TLSH
T1EC84F72073F94218E9B70B31ECB651C51B76BE67BE14CA2F2449315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a67be.rbf

Path C:\Config.Msi\e5a67be.rbf
Size 131KB
SHA256 a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a
MD5 d8a76dfe6188e600bd7a8480dcedcbdb
SHA1 40080e226be118c2a0a8f9dd70879467ec09f198
SHA512 9a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76
SSDEEP 1536:6fg4S0dRp1s8PW/OvAza4KFvQFa8xVsbtglOJzgP2wNmqgEEFBt9Aak/pKohxm3X:0N1zvAuFvVyV2sUz8mqc9AakhNhxm3Ss
TLSH
T1D0D3C41B93FC0269F2B70B71EDBE45CA5877BD566C21D25F044A368E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

vcredist_x86.exe.tmp

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.tmp
Size 521KB
SHA256 4e10abe7aa44e67c9ee56bcd1334b57d3c06d024750a6ca7cf44a65918ac0ab1
MD5 27883da6b211c7089bba60707305f3f4
SHA1 11bb400a39c787fe2345562ced87e12649b927c2
SHA512 6a083bde5f738348fa6203281cb6da83083c6ab067c66dc1f340cd11120ebfb6ce2ffaf4fc51827ffc9ed01e05cae70377aab74784a35f710eaa433a3390c9b7
SSDEEP 12288:jZc0IursYCYQetnZJiqlEbXSb9NtoqOFBqkYH/BjvrEH7z:7MYXJiKEbXWtpOLlYrEH7z
TLSH
T143B4AF3266949272D2B21473F519D5307E7DE12C1F2544AB87909A2E3A7C483BBFB34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm
Size 650B
SHA256 fde2a6e7e10e54a3d910a718fea622cf32a170abd68488bfd1609c5cc9fd93da
MD5 aa75ec6fc2895e334f733aa579e57966
SHA1 298540ad762c7fba7c835ad4eb99e1e0eeae3208
SHA512 5d26baeca0f6d763d7ff9ea84a207faf7d8e95875d51040efd68427d5199bcabf87a3b8615cc8c24504e6262d1b88168b14dbb2e419e3020399bc25bfaa45108
TLSH
T166F0DF654FF38019F2B7AA7178F90616686BB8032931C52E0282328FDF327C0EC64B16
MD5 SHA1 SHA512 TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
Size 232KB
SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
MD5 824f1f188704d3de77660d90fea6b136
SHA1 9bcad1428defece9f2ceaf647d9571ca41b3f40e
SHA512 0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972
SSDEEP 3072:55Sa1UNmUq59Zh3pe8lwAx9JHHpXhvq5J38J:55Sa2qr/HHpxva
TLSH
T1E7344C11B552C133D8853332406FDFA12AAC6EE79B52C58721E932DC6EB17D4D3792CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 28KB
SHA256 6337a3d86b708f36fdd3ac150a07dcaa9f33fcd545579ef95971f5f5f9ae7474
MD5 2372f44b04b0d1e77d3ffb59d55d9eb1
SHA1 013042a88b2b2ad7e87896bb9d93f15a67d84daf
SHA512 aed2f372d7afe4f516fe1ebb691967b4b33b528ea1ea643e029e3717b38675f3749ea288e6607d4ea615a411d5ec6095acc7229e1770c20cce6ce295531a92ff
SSDEEP 768:194RKPFJsE7ywY1iPLH57/iiGdBxeEo31gkaR3R+/2miI9i:CiPLVitxeEo31gkaR3R62miI9i
TLSH
T1F5D2A226BE48417528E0C3F5D1359A82FB3DCC732321EA883CE6C4F5756B522E17E6A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
Size 971KB
SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
MD5 1eb17f650462eea820f4cd727d2d3ab1
SHA1 688f59160589ffa293502bffcd5c0e62e1993903
SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
TLSH
T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
Size 900KB
SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
MD5 3df1d7da8c1493a5a00c0474323fef20
SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
TLSH
T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
Size 101KB
SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
MD5 ce18bc86e63f3192719ce0d7f286a130
SHA1 86a935fbd2fd9f5b39307ef986146cb2ff2adc33
SHA512 236bf295e0551ba64d743833ffc5c1d1b5b4915c9df5ccf3300013c765befb37808651087c388962e2f7bda0a143a406f923f408a24373cee9e6cda49aae5b73
SSDEEP 1536:7Jr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016kyBekazo:7Ji6vPUL7zxwXmh8Gf99XZ7Bwk
TLSH
T125A3F81483FC4F61E6F71B742DF6A0814A72FA625EA2DB1F102D410D1C63B949A62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Size 27KB
SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
MD5 d0958d7bb727740c9d9952b1805163fd
SHA1 a3b18971219311fd6a7e5f2be14979c3777d4d68
SHA512 138bd86e0b1f0b32ba453475e1fa81e11e9d4300db197b58301a5d478b3213079dc30c700f52220ff957fef10c4c85d1230308d83cf7560547b475fb346e1460
SSDEEP 384:Sp0wdaXOa1FnKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81dWIY83gWQsLBiHR1:O0Ka+q+6rqnDPOyBeRmoQ9zpI
TLSH
T139D25628D3F85312E2B38BB099F5C447AD76B953AE34C7AC2596534D0C227849963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Size 31KB
SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
MD5 55c9882d7612e7e8b69fa5920410be3d
SHA1 9517d22cc6d9c7f9b64d2c8152849a9075027c91
SHA512 a6fc94a8a0d6a690493819efd463b5263871346a94e7a1caa379871dd1fdc6527311b02eec70c5b49406aec53bf4e2d04d14c592754bdd3f6a251e64f9e2b024
SSDEEP 384:F52RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYWcsLBiM:3urKjgEnGEFiJrvPAOyBeF29zKk
TLSH
T1A8E2962893F81312F2F35B70ADF5C483A937BA03AE35D76D2586174D08667849963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Size 137KB
SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
MD5 b5c91699e57a807b2143cced62e70e77
SHA1 067f80a3c6b16ff9c4acff06099393084b6368ff
SHA512 d843235998b04d8f857239b31b5866c5328de3455b330f57be5f61acccdaadfa174231cbc57eb07f8cc5f7f3d8ba598fa0399fd8d13759d3c428d31a07265003
SSDEEP 3072:nEmV8EKUaX1IrJeE+6pwluGCulHxTqo+UeYBs+:nEm5azUaxWIN
TLSH
T120D33B11B7FC371AF2FB0B79A9F96001C97ABC556A26D78D1851424E04B6FC08A32B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Size 79KB
SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
MD5 2c100809815e27163493ea5e81010d1c
SHA1 01ee717e6f9d6c3d574ffe82c1cff3cf2467419a
SHA512 c22de3606e5cd1a9ac2e1cbca3c156831d5cbb99a50e4ae9f34df7d93b4d9093447d62b3fdc031be84a6c7adf16e23f7b5b44ba4eddf21bca13a26704d8a6b63
SSDEEP 1536:QdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHp2gXmyBejjzQka:yYR63P8dlNGu1IcT7TXLqngXNBCjkka
TLSH
T1F983391193B88327C6FE43B464F0A8125FB9F253BEA6E71D09C5A39A48537C18D5272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Size 85KB
SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
MD5 33247411fefa060b5f86eecd66b95078
SHA1 74784f9e3da6f1579a22f5723d46c5de50add359
SHA512 c1ad16c956cde61fee693b1483905ab6711841750bab35848a1e7261165f37273d8380daf8e6f4d2d35d520ec52fa943938f3ae7ea056a112bc9200d7e49c136
SSDEEP 1536:kkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79sShdX+yBeS2TzR:kk3gCbzexZG0YUBXfqidDhdX1B+Tl
TLSH
T18D835B27A3E85713D7F74630A8F09A03AA71FAC37565D39F2046672908AB3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Size 44KB
SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
MD5 c2e0ecbe64eb072ed008257142315526
SHA1 3d732f858fe67bae8f369ef19ef282e11a83f656
SHA512 5e0d2a7484e63254e455d6e9da44f79533638607e41d7c4eaf77529f6dee50904a675d8695a8e5c0ac835e813f2a7e11e7b1e0cfdb82553edf653451fe816203
SSDEEP 768:Tc1JB9Xaefxf2ZquXoQGaVP6rqnig3MbvyBeHO7Ex9zQB:A1JHXtp+ZquHVVigczyBeHljzQB
TLSH
T17013D72493F80313E6F757B099F1E443AA777953AE29DB9D1099574D0812BC1CA22F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260712173410_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260712173410_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 8fbb6cdafade2de1a24c85e694a055504afe4899664bd4b19121f933cb1f1325
MD5 54dc03a3cb321f0c59b981d177ed64dd
SHA1 c481f3828133702a0b551865f9dff5a9af0da969
SHA512 12232b5db2cc4f5df2e37eabc055ce694159dd2af13ce501eccd26673a6c2253c31fdb3fc9232a53d85ab386563fdc4f174dd6af7e71511033a74a83f0ac0f5d
TLSH
T1904116601AE40807F5B256076FF3C9625E33BCD6A8349F4C2248C21A467BC0858BD7AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260712173415.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260712173415.log
Size 10KB
SHA256 3031615b9171b59945591e2d3dae0e16af542a655f49fab89d5ca9b17d18aa5d
MD5 342b89e7ec8e55e7c615f4feb0b985d3
SHA1 4a35a3f599841a25e25915cfd606507bd6a27333
SHA512 01a25c564c6cb3fb5aa21518c96787f5933b36f7f9be340b069f6934df189df1e1d1abed025d51692f3a624b872dadce4560caf138dedcf015132903f75ee022
SSDEEP 96:R8bA2D2SHnr1z151e1u191D1A1Heq/1Z/A0/MYdpavbqb0bNbJYNrqr+Yv60veZy:OTHnr1z151e1u191D1A1QKshKZiJbZ6K
TLSH
T11A22F2CEBB5DE2220EECC592E56B0B73F69BB125760070BC57D4014C731697ACA5E486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260712173415_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260712173415_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 971d07c24de49d559d92f38ccf70307799d85827aede09b995334b350a138c89
MD5 0f307858fa787f7e24437f52a49a0ad7
SHA1 75a772f75b056420ede411ba9cc88920d21e5a3b
SHA512 3fc77f4a99bc155d37cdd7f7082479e9bb161f27fc93bdcd3d266ce456b90d4eaf2e833088ed01e87a0a4080ab6b6347eb669938d8269a3480c43e547f774e44
TLSH
T11F4128652AE40906F1B31A07EEB3C1517F77FDC27835EB4D23468119066BC0968AC76F
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260712173415_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260712173415_001_vcRuntimeMinimum_x64.log
Size 3KB
SHA256 69698679ff5af2562d7bbf81ec6286413daecb0c8588637550b39e4ceda8391f
MD5 fd305985eb2ebb8476c300df0369c2e0
SHA1 315284bb71bbcb5187ed1e31f501842f3e8e22f4
SHA512 b710d5bcd0f7e7651f8771ad9515d5bb5c7039fcf8c78442be7e6c8986ffd93363e8d1ba0d24093f9464f5cb8a85d3e5b3cf84cffa2adda34442210e9559d30c
TLSH
T1F1510A315EE80C4AA2B65607EFB3C1526A33BDCA68349F4C2346C219469FC0959FC76E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260712173406.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173406.log
Size 7KB
SHA256 eb7059ce10d80c122d943491a738a9ee4496932c2eb9773261ef8f977ef2cd18
MD5 9f951068ab8a97c42da4604303dc2d15
SHA1 f6dc9e23449a2c2bc2c233e84487b4b0fd7cb2ef
SHA512 877480d23bec558e703222596455110f6e008345cc5dcb8dd9d4c1ba1c538713c99b03d9c4c327268fa34eb9e7585e1ce8e53039342f578558943c093b609d43
SSDEEP 96:5Co4bJbWbcbdbQYuXBOuMNCDbWb5b5bcDKzoEbsbjCSbq:j41OURQYxFFvocEJq
TLSH
T161E1208D3ED8F5941EDCF2BBD8B617E6D947F00D3240B274A2A5414D830A8A7EB8ED51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260712173406_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173406_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 5fc3dd813612586078bca53e0909dc32a0d95c99a8dc89b200b8f0f36be2d558
MD5 88cc321169eb99ec815d16cb6a0a7b0f
SHA1 6d83f60fad60907e736c5d87d5c27b39c1d39ce2
SHA512 38686784adb23f971040bc785ea806704eef55adf236eb51423e22527f7cceddacc3781a7aeb6753447c5fa8cdde622755d390874c22700d1a34a0d34e2a9199
TLSH
T16941C5651EE5080AF1B35647AFF3C1531E33BDC66934DF4C3248832A467BD0968AC7AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260712173406_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173406_001_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 dfa725c2e68ae9557d1450e9143e3d07cf64b7e4692e115b0173f16718b177c2
MD5 23513de2021e8e471f937f85702884b2
SHA1 778efe1d06ef4aa10812b732e4419a313a9e438d
SHA512 124c2e2a0aea2a60ead7d98c9282bdffaf8473ad7c3ac4a8581c06aea665c22ab38124a6a410f0c416542b0d80808c97830e4e930685d5c2cac69ed58800e54d
TLSH
T12041E5692EE50C45F1B7564BAEF3C1535E33FCC66934CF4C22858319067BE04A8AC76A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260712173412.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173412.log
Size 13KB
SHA256 b2e5e801a6c9073b3e160727401e46fac816d6ab798818d5853e8d0c499f85cc
MD5 0aa7b881fd054f0200dba3f9c1db70d0
SHA1 99601859cb0cf17310957bc2a6bae7c9756db330
SHA512 090c3386411400d674eb24c04be51d5e25c180a335988908ec5db83ec9b3034e7281526ef7d177e5b876e6a4835a6895cac426da1959908ca1ef9e19063e2dee
SSDEEP 192:8KyDnz1z151e1u191D1A1U+qHfuaKe0NVxryNGuPfDXOHTO34m+RA4m60OZQmdx5:8KGD+qHfuaKe0NVxryq0OZ9dx5
TLSH
T14F52008D7AA9E5185CFCC6A6E46F07F7C38BB005754060B87FEE11AD630A96AC75DC80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260712173412_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173412_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 8f9e91f310c9f57504180d03b673ab87ae07964adfd388c22cce547ebbfcbc48
MD5 b0900830f4e306fe98af5b09fa0da65f
SHA1 47b812ddd6d3cbf5ad716cde76f2a3755d92b71d
SHA512 9b025f821410219693a7b64ba36c6bfd579b40cc18a4c05ac1f124d10590cf67b3b239a97b025b34acbd9d1cc2348cdd48a2f6719553d29496fbde9916ace47b
TLSH
T1D741E6605EE90807F1B32647AFB7C1511E33BDC76834DF8D2384C22A466BD0969AC76E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260712173412_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260712173412_001_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 951dbe831fb57c414a82aa3054197aa93682d603f0bdc8bf455647e82202c8d2
MD5 707e130bc4c8f4abd2fb0213fb2e7631
SHA1 95a6c8eeb116fa09679c6950162a20fe0eecf78d
SHA512 83b08cf3a95e6461692fd291974f2c973d95b96f43c420161e78735be208e14e667e625f6f0253a0e1e7fb3429ae9d666868190d37e85d5d716305e708a3e54e
TLSH
T1364114B01AE40906F1B7564BEEF7C1520E73BDC2A8349F4C23448619466BD0A6DAC76E
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 246B
SHA256 30a391e58c990a092796dd0550793417f789d688f292dbaabde9e9c621f7572c
MD5 3309d5c3da730fcae9c7904f78842f1b
SHA1 ec2c0f39cab49805bdc12eec6ec561247df8125e
SHA512 058312e30f263b0a80f993d7edef59eb7f562d733b0ec37213307f088d56fcbc9eb68864e09ceb27bb75a28c8d76875d1afe73d712cde22d594a187b51b9b18d
TLSH
T1C4D05E53A40C8B23DB3423000FAA756A3A7507665284DE9654CE84527302F8FC07EBAB
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 444B
SHA256 41003892d44b17fa7d9c7de581ac9c95114ecd854901de87ab06963e923d4b8a
MD5 a9f98f571d9be44536ba769a62b75ffa
SHA1 fa563962f7b34410bcbacb5ceb96e5bde307de70
SHA512 cf027777bb2ca1cd94ce48dc4bc509db93d4abaa4ac701f94c765f5f4d2cd9766a94cfbad9b17a2f9d279d75e3ebefe6787837f8aa1cd855730d0bfafef8ba12
TLSH
T120F03743A8148066EB311301576F771C39755F77029496C999CE88537116ECFC4AF69F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 9fe8569e638d78207063ee60211f6cfb7bbc3bc2c87448e11e0eb8baf4094a3f
MD5 bc66f31fecd60ef1960dab28cebf95f7
SHA1 7e01f8d33a08288e4b5ca7b3a2da7ba78317d5f9
SHA512 7ebbdb300500a99ea1b6cb7c68940bf2c66372af7bd4402bfee229bd27537ad75816bf10690c7818c7ed00702927731c4f56597cf4d37251bb182c0caf76d8ff
TLSH
T1ACF0E987A5084626DBB413105B6A765E3562572362D4CB8950CC88437103ECFC0BFAAB
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 f31953e6c427fbe7669fa058651d5f248ef93e59a7859d5797865a54e44c9642
MD5 39be2d03301ce9c94fb217b1bd117c0b
SHA1 7e28ca09ab9cb687bba8ec0d3c0f2ac2b8cdabf6
SHA512 fe70a9ecb8ed84ca2fa8cb9a5adc55fb718955ff68d4d9e52d52cc4ffe76fc9ea1aa06d6d35632a6ef9238c26653b0e4f7c9eb14a13f51c44cbbe588b36aed97
TLSH
T14501F947A5084A27DB7013105B6A766D2966172362D4CBC924CC48437143ECFC0BEAAB
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll.tmp

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll.tmp
Size 202KB
SHA256 85628bae3414465e1cc090e42b821a158dc7cf742a30bdd5e57195b85ab1e922
MD5 cc7e2613a4f3aaaa71b084c20ffb8c07
SHA1 14b068c55b2222c92c12b52a37e19cb291d1e006
SHA512 8e0e4278d837ae739890ab15e44057ca7c8aa4d01da8a31d922361770ade8faf503819551d32eca417b995f5943c6bb9a4dff7ff986742a1933a6a3aa123858a
SSDEEP 3072:BiPaAuXqx9XubY57617IM6a9y3+7ZWMvdM2lQBV+UdE+rECWp7hKwjiq:WFEI9+bf7IMldqBV+UdvrEFp7hKwjiq
TLSH
T12114AE4132E883FEF1E21475311E932059E5B93C09EA84CEAF421A596E3D693DF7A707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI82FC.tmp

Path C:\Windows\Installer\MSI82FC.tmp
Size 83KB
SHA256 ff95ea08d4eb2a9879c839179b0a0bf223268afe84430f23582208c814ee19a1
MD5 08895ffbb06b9e35893a77b8d613bc53
SHA1 8826feda89dc5905d6c327aed3aa839a510b96be
SHA512 fe213b0050b9346b6c7a8583be988870e7442c64407fbbd98d952653e206037c108780dea9f0ea9c51346d021935231a774b040ecccaa6123869e6318517b1b9
SSDEEP 1536:aChZ5oVlwKpAQOxQ+/hvFTTMJ0vR2JeLEUTXFTk2y3OI:vhZ5oVlSxLvFTb0JHUTXFT3y3
TLSH
T150838E2275A4C17AD0AB5976A539C1711F7EB0301BB0C88B7B560BAE9E31281B7B7317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9A83.tmp

Path C:\Windows\Installer\MSI9A83.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA474.tmp

Path C:\Windows\Installer\MSIA474.tmp
Size 80KB
SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
MD5 393da89078925f78e19445882c37fc59
SHA1 1313f4e6c62670f1b10aaec77c105be275f50121
SHA512 aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
SSDEEP 1536:d+/OTT4YIb6rkCGoNGXbGKauVj4eKtHa/cJg95k:4OTMYRradauqCcJg95k
TLSH
T1AC832A2179E1C231E8E2777406FCA6622D7D78B14778D4CB778842ED8AA17C09B39367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAA3C.tmp

Path C:\Windows\Installer\MSIAA3C.tmp
Size 165KB
SHA256 8aa9ee293b304e3368dfde27d35538f9676f3440ec5536e58ba9fe3ff7841d68
MD5 1202b90ba913a9b5b227749967d63b57
SHA1 1817119db41ec35139aed53440f3417969799d64
SHA512 851d9163caa5efcd1490d55f8238c7c338ffc3ced17021847406a1890f467a60efab4e19549aaaa82ee809ea46f882d1eaed8913d759b7e675e2e99bb3a7496b
SSDEEP 3072:igN6wMs19DGwTUxlwZRlKCCDjshYsnY0T5aPX/lfgQyVqkHKBFdI:ihwMMDjTUsxKCCDjzsn98/Bly7MHI
TLSH
T151F3F78173E80079F5B3E678DAF54656AB7378429B39E3DF0250426E0E72BD0AD35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB86A.tmp

Path C:\Windows\Installer\MSIB86A.tmp
Size 97KB
SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1 a520426523be085ec67291241f4219ab13f4d4b8
SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
TLSH
T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC048.tmp

Path C:\Windows\Installer\MSIC048.tmp
Size 93KB
SHA256 fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
MD5 186694813c3d5e33202a1a72c5079cc3
SHA1 90a9c2bf6419be6f46999e137c2149feca62cd13
SHA512 57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b
SSDEEP 1536:NOTekneIYoT5jmIN0gaD4Prbde67Z9AlIZzxIgU9rHUD:NOTekSoT5jr0BDKEawIZzx3U9oD
TLSH
T16F934B4523E840B6E5B7927CC9F69A06E772B4411739A3CF1174829E1F63BC49E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 156KB
SHA256 320c921b75fbbe236010937e6895530fc823d80c346553b763aa10ed3725be81
MD5 81393c8c9cc087b7fac6857497b17daf
SHA1 f8e24e5ec9d8543d9fb60a90f99e9eada136d1e5
SHA512 75c063c76b239e2b51eb9cc598e5d0bbdc2bd9f9d473e62d33150051d8a52523504e4bb71d89f7347c63884714166df3ef9ca85ae60d21e590fbb4f9a637e5a4
SSDEEP 1536:PO1uWuuA+Vsy8guWqAYC8Cm+S0qQWKaCX4T0Cy/a+GWiSsgw+mibNpE2mK6qQKCD:ZyowDTc7/dL3
TLSH
T110F31119122D51916E9367C118A82B97A3CF4B9B6BBC066CF778362C9E5704FA3311F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
Size 150KB
SHA256 237b09bf55bfaa50a9c64d4f2cd814cf76ebc54ec6b15ba053d9efa0a94acf50
MD5 49a7d172f5da15243693736be2750712
SHA1 4f1a963d9060a1adb82c5178c937963a90b476fb
SHA512 c57b972f43b04a2abdcc870bffc5d98e881afe75f9e33d6ea684eec16a7b7330c3562e83e001308b5b7f1fca5e05eec1e6cf30e4d3c1cab3d39d544ee6ca939c
SSDEEP 1536:JSd0iaGysACM8UuqeVhgqXsOEaG6SaMsISdq2soCUP6sGkWGqCDVMlZ0yiEiJ1BL:eMfPE
TLSH
T1F6E3E21D101D95926D92674211983B97A7CF4F9B3BFC0A6CB778362CEE4704FA3291E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{2A91DBFB-06F5-441B-88E9-1F4915589984}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{2A91DBFB-06F5-441B-88E9-1F4915589984}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{A6588348-BA5F-43A8-8B11-646FE78A7784}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\1WLSOUED\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Size 360KB
SHA256 25e23e4bc78db831a05fad7dc758354a932278b42b1b7277b62a75c717e89edf
MD5 5cb69e557b5b117597246c9e67cfdc8c
SHA1 f36af240ff34cc7c11c6ae1f0d67a0abf1496576
SHA512 9af38e10fa70186abf4088e86a9b45b79b4e6a41d20348f56da07fd8415ebf5d3695b8ef41962bb39310f5dd3436c2cbe70ba3982c720d7beb7b80b5ac6b1616
SSDEEP 3072:RyWCQQzXgPice1NvAbugFh/jLqthte2Seh66LikrKwQp91sq9kAatVrmCK2phJRS:UWCdDiyvgmiL54AaXDBP8v
TLSH
T1B174D62073F95208E9B70B30AC7692C51A76BE677E15C62F2449314D6AB2B53CB23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.dll

Path C:\Windows\assembly\tmp\1ZA77C13\Microsoft.Office.Tools.dll
Size 18KB
SHA256 02d0d460ec66aca17204ef8f7244e2e34e117c7f20aa07e98cb83a1386a1146f
MD5 c7af388d0d92544cbc307cc692f6dc1c
SHA1 660b07bf79682e91b23824fa327950bfa8c73f01
SHA512 5a8d81ed8fce9eac5175c676f7db4cc147f4f2999cc9e010de4bf87c79bd106c45d0c8848f1cb0eb61a7ad7cf33d2d4881f9cce588cce4d841bcaa66ec8f187e
SSDEEP 384:H1LtwmrH+WAnmkW/MwWVsLBiHRN72lkPtHNsAR9zkwm/:H19AZvyBe6kFts89zni
TLSH
T192922A55D7DF8EA3CC622C709DF4D7423E3CA7835D12DA2B0689E5192CB3394C521729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll

Path C:\Windows\assembly\tmp\2022CPUE\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Size 192KB
SHA256 e51a6c5e34b5e1ac743fca62a8c8d82f3e5099914745664a23843f6276e89039
MD5 91cc9825305d8554054d097b5418d7fd
SHA1 750eda13cddadf3f38de3df25062cc4774e019cd
SHA512 c1c82bd4859e0db7763f6e11425eb02270cec54ce79c0f848e1be5cab2c1715b7e9a96f12d9d2f11d5418881596837b3fbf84254be9e77e84b01a2b11c646802
SSDEEP 3072:0cs+QnXsia21rUBJeImxRGluQriZY+/ZCX/kMrICBX0a:0csrRIHiBtkb
TLSH
T1F3142A2467FC1B15F2FB0B7AEDB5A0019A76FE662913D31D15A0419E1872F80CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.dll

Path C:\Windows\assembly\tmp\2OM5QDLF\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Size 78KB
SHA256 6ca890e728f1bffe2cdc670938d9c17729903f9eaade142775954ee5129b78b2
MD5 8ca4448d8a87d4edc29064678840a65b
SHA1 389ee39f6060e9b31a379e65d3c998a3dbe83b40
SHA512 b86efff7aff40a0d2750d6c4db6ed7095eb942720b972350f8cc87dcf3c666b09865befe885a57058eaa1e7aa3c5c56119324a445eabe246f52d236fff834483
SSDEEP 1536:yskby0ayhkM+TeVCB5+G9cTvdQc1bqMsDNb//pasgNiiHyBeljzQz:yDbyihcwqHba3NbSB8jkz
TLSH
T19673081497BA4FA7C2BA4378ACF1424256B5F403AB52CB6F18855F481C73B94CD13BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.dll

Path C:\Windows\assembly\tmp\4GXTMEB6\Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Size 204KB
SHA256 ed512630534121de6e87259230aa7d67547b810bbe54757b561c9cd86428a316
MD5 6cf6471f917d139fa7f6b57a09156a8b
SHA1 896f482ed5892beed0cf3d74cfd599c2980d485b
SHA512 2192f731aaba560bb91e85ca5282943dc7c4bfde708690808487cb966c1051ead73f63a71f75cf52d7fcfd9141fb82c3f2d1edebaf21ee87601aa5deeca82cc1
SSDEEP 3072:00uKb2fEejyG2iPklibcruOVTzk21wxqWX58Kn8p6/A/C9hSrBbQ3t4N3BMjkf:b8cXqcfDKQCGP
TLSH
T1F6144B5663FC0726F6BB0B35D4FB11026E76F8172A53DB0C688A469E1971B808A73737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\69KDTR9N\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Size 44KB
SHA256 436215d03a6cd3b30d6b2e7006aa4a83f7c3291f3fc0b4ad86ff55e70dac8650
MD5 1190dedce8f1b97816123163216dd096
SHA1 468d499041ab141f4233b23d53ffb9a203cfda35
SHA512 fe35ddd5a4a600cf840414f8859691f5894ee779517f3b069f97667e68f6cae54836d393091f828dc9541c6fd9dbac4a77fd53eb3840a8d3dfda8d21373fa710
SSDEEP 384:MBk39BmxOVst4SCtrpuXYa1pbr/0K7yEKJ9Yu6dnPU3SERztmCJMadMardz/Jiks:MGfZs5CZqlj26rqnuMztgyBepmoQ9zpG
TLSH
T14713D769D3F84712D6F74BB06DF1E4435936BA539EA8DB5C145A530A08233D88E22F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\6RZRNWAF\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Size 38KB
SHA256 b2673e6faf166a80f9f3832234508d25f3d219eafb6ba1d8d16583aff3517793
MD5 792d885a3d06f829956b3f0461789f4f
SHA1 f5d023f2dfcfb369bfeed2815da8c1ca54a948f4
SHA512 55e82a9ac9a9bf8a3f3dfbe4e529629a11a1df48774874509b71e062d7f754178b3a87f49d8d46580cf3aa9af52ba03747c980c8422456538d6c52102f1ce24d
SSDEEP 384:Tght+fMtSM9jmxa1CFbdKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3HW88NWXsY:TgX+EtkqP6rqnGKKyBez69zo
TLSH
T18603B629D7F84312E2F747B09CF584837976FA53AE38DB6C15C5934948237848A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\6ZJXXZIK\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Size 38KB
SHA256 d182d18bbf9526dd0eb821eabddc885b80ba8f6dde2c9e0bb809fb55c14c7c47
MD5 32c152242c691677b866356014498d2d
SHA1 fc75591a894f0e8b5aecbd0bd13e3184df0c4f38
SHA512 bdf69a1b755f176e958f6d4c4e2e7c3ae74000a43266873ba602436c089983d0ebcf6e26344a15d8b2001ae74a798b5dacdbdd7cbc206426783704b036e05831
SSDEEP 384:bKQOJrYa7mdessomj5R/yeizfa19crXKJ9Yu6dnPU3SERztmCJMadMardz/JikPF:OQOVYoxVUq+w6rqnzxAzpL5yBeL19ze
TLSH
T15A03D628C3FC8326EAB347B0E9F5D4876937B553AE75D7AC1589630D18227848523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.Implementation.dll

Path C:\Windows\assembly\tmp\BPNYE5MH\Microsoft.Office.Tools.Excel.Implementation.dll
Size 459KB
SHA256 1e9f1d847daaf224c7b1ca265ecb7bc293b0df70b3a299b5da3bdb2978bc7df5
MD5 2c93d41b14f129c61d2993baaf2e002f
SHA1 96e54e9b760391683eb617baf03aa444d124472a
SHA512 21808de680825d1a1a2cd003bd5b479c2ae725e54071ebe4e8aff5b0fb000ffea3eba1ece98631ab3065a8cf6c2786c1d9059712931e2fba0410c7a2b53e31d5
SSDEEP 6144:y6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNiuNfVdKy9:y6jwRSvQh42RNjN6AVdKy9
TLSH
T12CA43C12C269D33EC2AE833750A226155BA5B2EFBAF1EF57A013C5E82C537C09D41E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll

Path C:\Windows\assembly\tmp\BSXQVCCT\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Size 155KB
SHA256 ac12705a2b9470ef07732f500bcd8b2844282be1f609f5aa74b0dd3f0268362b
MD5 7a17537e156d75e293aa693423fd0fd6
SHA1 2bafdfe9348c0a39dbfdca35d7a04d925bdc82a0
SHA512 ab38de8c226a7361d0b1d2adb3929585ebc214ea0b967e7f851891f4c2c451030fa38cd8c3978f881ccb90339e40272c0522aaffae8073e9a4c3467eb3118fa6
SSDEEP 3072:i0anyn/CiBk6HOIz42IJqFF/0/QAWwTrjeK4BED:2n+VEn08
TLSH
T108F32A5A63EC0716F6FB0731A8FA54416EBAF8132962CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll

Path C:\Windows\assembly\tmp\ECFAYHVL\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Size 134KB
SHA256 df0deac24f6371b26da9f34c1ce21e7d3fb7e4a4d75c42745c265b4639cb3e82
MD5 d8d3a7296bfe05f2355f96f526f1dce7
SHA1 f1ec56517cce54f75fc3b8cb3f82f901cb3d96af
SHA512 67f3816e595f472f3d67983e7207cbd643a2ccc3f6187bd94f2ca32dc2cfac3fb7daee7b5b05aa8ce46d829b99687cdfa4f34e802835b90955b126cfabadff48
SSDEEP 3072:ON1zvAuFvVyV2sUz8mqc9AaZiNhxm0bBzC:OTv5tAaKWQe
TLSH
T186D3D41B93FC0269F2B70B70EDBE94CA5877BD566C21D25F044A764E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll

Path C:\Windows\assembly\tmp\EGV38PO5\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Size 200KB
SHA256 0f5b5e40b8a1708051250bbc9e36ba35357312503beb0004ae6a2cc5a20466e8
MD5 9828dbd687c6ac093d40dfd61de68a0e
SHA1 9c96f865e83d7deae884321e76c87553c6088748
SHA512 001852557d9bbc33cb9b274277d2e24b63b1d46b253674f13eda857f36bf0718779242621c14809f902df041283c8302164d584a4e42be3ed11a0cef591f7853
SSDEEP 3072:SrFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirP+R/x3zKFvlBz1:SrFAoOXcHfIfiKkvx
TLSH
T11C142910A7FD1B25F6FB4B79EDB6A0018A36FA263D13D31D15A0419E1876B40CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.dll

Path C:\Windows\assembly\tmp\EHUUUG2E\Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Size 84KB
SHA256 cd56f6c0e64ea02f2a76c880a55721929dd7a2d9eced52b82122618dc2b34c18
MD5 1150e66eaca3d36ef28a7551337b6ac6
SHA1 ad37ef180a8d1c81cbdf1595bdc802ba070cb03a
SHA512 a2862ac8fd62d4261427c2217d9c02d8df5dd7f4d3a0db0bd826421050d6ef8e39e8f630f079622905dc343e16f42c1d80724e1d4132d4c9d068f089d50084c6
SSDEEP 1536:nb4VV8XW/Og9NCJ7qBEPzm42yEAWQ0yBexjzQEsC:n2dWqQmyz1LBUjk8
TLSH
T1E383195587FC4716E6B74B70F9F78447AA33F967AA23C78D1408824E2851BA4C4E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\J14ZCWHR\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Size 65KB
SHA256 12b2e3ab66fa23e2814d937bc24aae3591516e61c667ced481f66a3d55b66a4c
MD5 dd97df24a39663be2d217fbb4bddffd0
SHA1 9ac8d23ec7c8655ae5bb5a62eda61871030b2a4e
SHA512 f0de89568b550f23b60fb4b343682e7b4ffeab9c571127376815d22cbb3b93a2c6081831a24c7fde7977008a72ae4395313202af39e95095d2c3d8360bfdbbb9
SSDEEP 1536:4c7HHzMKpyGZ3Jr249XJqZqSbGJyBeMczZ1:4c7HHzMDG5JdJqZqGGcBC11
TLSH
T1A6632924D3FC4723D2FB87B468F188839A75F7836DA9DB5C1485532A08577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.dll

Path C:\Windows\assembly\tmp\JORG2JJ1\Microsoft.VisualStudio.Tools.Office.Runtime.dll
Size 393KB
SHA256 2bcd529d5c2edf88d3b658816d72d1207df773ffbe805e7b5070802782c23c67
MD5 8640c74199160c6e932a5f55cac9d9c8
SHA1 661d08a2ca504c0e056bf3ddf500d9cf610ecb42
SHA512 7c06470c6ac2c7bb8bdc4fdaa81c765c810208200f059fef2cf0ddb9d815fca705964fd062d187e4e189127096690ad5ae9f4a74c5ab12b486057141e3f46332
SSDEEP 12288:P1lzmzzzzfzxVzzdqzzzzHUzJz8gXUAaBn:NlzmzzzzfzxVzzdqzzzzHUzJz8gEAa5
TLSH
T17184E62073F94218E9B70B31ECBA41C51B76BE67BE15CA1F2445315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.Implementation.dll

Path C:\Windows\assembly\tmp\KZ1TPZFD\Microsoft.Office.Tools.Outlook.Implementation.dll
Size 140KB
SHA256 326bdb32503351a9b99fe69eb884a5a02d4bff0ff2c7b8b3ce9674fab9fcfc31
MD5 0f7bc383c04833cfd5e6d6f6d5b9f9c7
SHA1 29f672f4c8dfb820e42b54a9924e93ede94481aa
SHA512 d3a7b278a7244c13a887d2a50b8aee39af38fa8dc02f7566a3c9b6e02f25415e2e009cc118d923d22c55c223961657d832a445f897adb4a5649d70e9e9cd2d8f
SSDEEP 1536:oBjLPfRUqxc0O/t4DErSu9e7EMaggaqRuDPR6TCZByBe9zi:oBfPJUqxy14DEF9e7D3gaqR4PGIEBi2
TLSH
T147E31B00A3AA0B92D07555341BF2B542EA3DFBA72AD5E75F5411CED80CB3B90DC22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.Implementation.dll

Path C:\Windows\assembly\tmp\OYQHBM00\Microsoft.Office.Tools.Common.Implementation.dll
Size 354KB
SHA256 1bc4ff4e9cc85d9457e80276354f643028c01c25414d0e81450bb52ed802e93c
MD5 00ee8a57705bf407a2fa0606b144a13c
SHA1 3c9a6ed3cdb6d167da2ac38518c3820985e4b6b0
SHA512 9197e0ce0e8979b7d8c8e5b95ef5b9bf22fe8cc803b26c97b3c44d1d9e095f85a2a205eaa57152a9843b8fdb7751bdbc1e64cb3f3f04d3952537428cb427fc93
SSDEEP 6144:iNeM8oM6s8alZ+afj5OAKOQ4pUE9wttHqr:O9QZ3j5IOQ4pUE9wttKr
TLSH
T18874A415A3FE5761E2F70B34ACB40489DAB6FD479E6A974F2445A14E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll

Path C:\Windows\assembly\tmp\R85NTVMH\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Size 64KB
SHA256 e36435590e80c1d27493fbb9cc2f7a402fb3207e7210d134233099d1c01cbe8c
MD5 64939e920a0619adb8e395877237b560
SHA1 c05ecc9674f7a9436a227da429b474910a163d9d
SHA512 05281db2372f72aa9ab44ac3dab79a3e506390ac6b317180273a32d6a4f82f36128b75ad7e706333dfe318766e21ec8f42a72e55b875faf86e152d4d592b624e
SSDEEP 1536:ZZan8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsmjhGBDypyBeQjzQC:lMPG7wqLDy8BtjkC
TLSH
T1F6532A2893F84723D6FF83B8B9F191435A76F543AE61CB6E18CA938908533D4491376B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.dll

Path C:\Windows\assembly\tmp\RABFOMJC\Microsoft.Office.Tools.Outlook.dll
Size 58KB
SHA256 89d6f51dbcddb10ea2c4e92e6360e9fc2c917cd8d9f1aa162d6a47f7e940d899
MD5 6c7bc83cf1080985bb2505ed9c090c86
SHA1 64fcb206e3280b935c786d72ba34ad854bf74c7e
SHA512 8b2a1d334f01e7997bb6b5c7752d9a275714b811ebb293e95bd9b1be7d2bb44484998ab1fc1845fb7e6f4df4613082fa4ed552a4994961fe611a92b93e0ca9e3
SSDEEP 768:jRXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24nbxocNAwkEGjhl2BOBaBnD/sxFsN/4:SSk2HQq9D4bg3yBeOkmVzpqZ
TLSH
T1BF43A382920A96D6CC55A5742A70FB52E63EF3FB1BD0B65F8813DCF408A3250E905F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.dll

Path C:\Windows\assembly\tmp\RFCL6XZI\Microsoft.Office.Tools.Word.dll
Size 142KB
SHA256 bf5406b6657cc7aca2db714ec375efc3ffdf4cc32a80f938b3dfa502ebdd26f9
MD5 b24ae31036dc11fe6239397a22e8c659
SHA1 40d2739f8d2c19db095db4ef4f1a9cb6bae7880e
SHA512 c713095f297a37458edba5f9bbd6e04e9407089b3f8e98f9c3c52e9711a8be01a3e7268ece3837d1e0438588c50406eacf7afa5bab08d2ceba68dde76ea27915
SSDEEP 3072:jrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO8+rCo7VBpdfh:jrwBZWkge7DuV/7Tfh
TLSH
T1C3E34A91EA35C259CE84C47D3E21BB00DB3CF3D644C2A79F4526FCE80A9B791C552E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.Implementation.dll

Path C:\Windows\assembly\tmp\TOC14DDH\Microsoft.Office.Tools.Word.Implementation.dll
Size 337KB
SHA256 2585cc5fcf73680a5124d8e0a08a27d311ba903cd7bbffee7adbbf8d188c5f28
MD5 87d634d0fd6f8e13b0141730916d78a9
SHA1 8591e58967be097ab8f711395ec0b55f72d902d6
SHA512 cf0445d2d697f256d3421ee480eca5ad83d3c897c8477fd30828def534b2a45b72f5dd0e177dedad61283d28211707d7eec3661306b3c504203ac36beca377d6
SSDEEP 6144:FtlRAWy0iDCyVMvUYKZ+JICHNyPOc9Yh9g:FdXyyuMvQZ+/rc969g
TLSH
T14B741B154268C32BD5E8C235BCB136124BBDF293BEE39B2B613695A81CD37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.dll

Path C:\Windows\assembly\tmp\UE84LHKI\Microsoft.Office.Tools.Excel.dll
Size 171KB
SHA256 a4397784c26adfec3393dc421d27f826099a19f1d55b64a2e6199d977a37515a
MD5 acf3804fead07de2fc137e95a57494ec
SHA1 d8b82e20db36ebf1dd2b27d8f301e59c0fc62565
SHA512 e21e42e012a0599f99c812ce4cb520d9219ddda15fe5c05241b6aeb17d0df4103877c81877a75b55271b389fc12c2ad822c2e4ec8e72a750d17b8e22829c3736
SSDEEP 3072:VWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vamSxBAZirZANBtJ:VnMr8CSQ09ap6Jy65Rm2v22v
TLSH
T1730419C1AB0BE061DCC9563C38AA7B056F3CFBD295D2EB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v4.0.Framework.dll

Path C:\Windows\assembly\tmp\UGLCALEM\Microsoft.Office.Tools.v4.0.Framework.dll
Size 30KB
SHA256 8b1af886189a4f9610d1e38aca9d71cfd137e0ecb326d7c46cae9264c3faf097
MD5 7fdb0de95e06f278b3a08581f25a435e
SHA1 f7b03fcd3c6d8c4dd1e65a689a73acbfe5c2a3ee
SHA512 8a289b9c4c82c3d8c22bfdaf57aa0416de14f6bcb22e9a3e10630fc158c65c48fa012a8946423950a65722fcdd0f3c643fee116ad848bd802aed4347a973c19e
SSDEEP 768:aHaVFSvPSNEtyJvrpc49qFkByBehN99zeXDF:Y29rQFkByBehxz8DF
TLSH
T19FE2185087FC136BE9AB0A707EE5D8815D3AFF526D62E21F4058C05E14F5BE4CA62327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll

Path C:\Windows\assembly\tmp\XF3OF2BY\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Size 27KB
SHA256 eb5162b64d9b6220aacaea4eaa597bdd02880b841db717e4bdca5d64e453b4b5
MD5 e7f28e9b4375963610ea0c6b7cfa09b8
SHA1 0f2157b7bd33fa24a7ba4274c9e5aa05c88a36fa
SHA512 c683d2faefffc02e73d500b40eb91a6055b0582ed16230c47c8030a4b5f8533f075354fb427faca1fcaec6b158ecd015ddbd481033159c2b43a40339a53f163f
SSDEEP 384:rd3K6a/IZa1fKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CdWbspWLsLBiHRN72f:rd33qo6rqnL56yBeucts89z+1
TLSH
T175C25328D7F84312E2B35BB09DF5C487AC76BA53AE35C79C1586530D08227858963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.dll

Path C:\Windows\assembly\tmp\YCG98G2E\Microsoft.Office.Tools.Common.dll
Size 93KB
SHA256 1f9e5b3df61e6ae400905e38ef3e3c8208698a488305554dbe9293887ffa6478
MD5 d75541051253a7528d7c14d60fdb3e27
SHA1 e03b4457b01aaee52fb01967a781d10001c6329e
SHA512 5399fdd80de5492ba106c8b29d87d4a6ab0ac329ab1f882c13662a1807b86dee5c2fb667ffd39b87d664b0baeaaa30738aae7b516e048a0f606abc01a9647cce
SSDEEP 1536:ey+zGztUjm2oNIv5oiIZZB8CFD4W8yBeNzfzx9:tzhNw5yjVDB0bl9
TLSH
T1CB930626A23684BDDDC9103C74983531A73CF3B78246A7871909BDAA4DD3BCBC987749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-3044-0x0000000002A00000-0x0000000002A0E000-memory.dmp

Download

memory/1128-3050-0x00000000029E0000-0x00000000029F8000-memory.dmp

Download

memory/1128-3040-0x0000000001070000-0x000000000107E000-memory.dmp

Download

memory/1128-3056-0x000000001BAE0000-0x000000001BB88000-memory.dmp

Download

memory/1128-3055-0x00000000029A0000-0x00000000029AC000-memory.dmp

Download

memory/1128-3054-0x00000000029A0000-0x00000000029AC000-memory.dmp

Download

memory/1128-3053-0x000000001C420000-0x000000001C734000-memory.dmp

Download

memory/1128-3052-0x000000001BF50000-0x000000001C41E000-memory.dmp

Download

memory/1128-3051-0x000000001B6D0000-0x000000001B6EA000-memory.dmp

Download

memory/1128-3039-0x0000000002960000-0x000000000298C000-memory.dmp

Download

memory/1128-3049-0x0000000002A00000-0x0000000002A0E000-memory.dmp

Download

memory/1128-3048-0x000000001B6E0000-0x000000001B6EE000-memory.dmp

Download

memory/1128-3047-0x000000001B700000-0x000000001B716000-memory.dmp

Download

memory/1128-3045-0x0000000002A00000-0x0000000002A0E000-memory.dmp

Download

memory/1128-3046-0x000000001BA30000-0x000000001BA78000-memory.dmp

Download

memory/1128-3043-0x0000000002A00000-0x0000000002A0A000-memory.dmp

Download

memory/1128-3042-0x0000000002A00000-0x0000000002A0C000-memory.dmp

Download

memory/1128-3041-0x0000000002A00000-0x0000000002A0A000-memory.dmp

Download

memory/1808-1839-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/2012-2817-0x0000023308C50000-0x0000023308C76000-memory.dmp

Download

memory/2012-2597-0x0000023308990000-0x000002330899E000-memory.dmp

Download

memory/2012-2785-0x0000023308C50000-0x0000023308C7E000-memory.dmp

Download

memory/2012-2792-0x0000023308890000-0x00000233088A2000-memory.dmp

Download

memory/2012-2799-0x0000023308C50000-0x0000023308C78000-memory.dmp

Download

memory/2012-2805-0x0000023309B10000-0x0000023309B6C000-memory.dmp

Download

memory/2012-2811-0x0000023309B30000-0x0000023309BA6000-memory.dmp

Download

memory/2012-2609-0x0000023309ED0000-0x0000023309F36000-memory.dmp

Download

memory/2012-2823-0x0000023309B10000-0x0000023309B68000-memory.dmp

Download

memory/2012-2829-0x0000023308890000-0x00000233088A6000-memory.dmp

Download

memory/2012-2835-0x0000023309B20000-0x0000023309B86000-memory.dmp

Download

memory/2012-2841-0x0000023308C50000-0x0000023308C76000-memory.dmp

Download

memory/2012-2612-0x0000023309CD0000-0x0000023309CF6000-memory.dmp

Download

memory/2012-2615-0x00000233089A0000-0x00000233089AC000-memory.dmp

Download

memory/2012-2618-0x0000023309BE0000-0x0000023309BFA000-memory.dmp

Download

memory/2012-2772-0x0000023307FA0000-0x0000023307FA8000-memory.dmp

Download

memory/2012-2766-0x0000023307FA0000-0x0000023307FAC000-memory.dmp

Download

memory/2012-2760-0x0000023309AF0000-0x0000023309B24000-memory.dmp

Download

memory/2012-2754-0x0000023309AF0000-0x0000023309B26000-memory.dmp

Download

memory/2012-2747-0x0000023308AC0000-0x0000023308AD8000-memory.dmp

Download

memory/2012-2621-0x0000023309E60000-0x0000023309EB8000-memory.dmp

Download

memory/2012-2740-0x0000023308C50000-0x0000023308C64000-memory.dmp

Download

memory/2012-2733-0x0000023308C50000-0x0000023308C64000-memory.dmp

Download

memory/2012-2727-0x0000023307FA0000-0x0000023307FAA000-memory.dmp

Download

memory/2012-2721-0x0000023309AB0000-0x0000023309AC8000-memory.dmp

Download

memory/2012-2714-0x0000023307FA0000-0x0000023307FAE000-memory.dmp

Download

memory/2012-2708-0x0000023309AB0000-0x0000023309ACA000-memory.dmp

Download

memory/2012-2702-0x0000023309F40000-0x0000023309F9C000-memory.dmp

Download

memory/2012-2696-0x0000023309F40000-0x0000023309F74000-memory.dmp

Download

memory/2012-2690-0x0000023309F40000-0x0000023309F6A000-memory.dmp

Download

memory/2012-2684-0x0000023307FA0000-0x0000023307FAA000-memory.dmp

Download

memory/2012-2678-0x0000023308890000-0x000002330889E000-memory.dmp

Download

memory/2012-2671-0x0000023308890000-0x000002330889E000-memory.dmp

Download

memory/2012-2624-0x0000023309DD0000-0x0000023309DF8000-memory.dmp

Download

memory/2012-2636-0x0000023308C10000-0x0000023308C1E000-memory.dmp

Download

memory/2012-2640-0x0000023308C30000-0x0000023308C3E000-memory.dmp

Download

memory/2012-2644-0x0000023309D00000-0x0000023309D14000-memory.dmp

Download

memory/2012-2648-0x0000023309DA0000-0x0000023309DB4000-memory.dmp

Download

memory/2012-2606-0x0000023309E00000-0x0000023309E5E000-memory.dmp

Download

memory/2012-2603-0x0000023309BB0000-0x0000023309BC2000-memory.dmp

Download

memory/2012-2600-0x0000023309CA0000-0x0000023309CC6000-memory.dmp

Download

memory/2012-2779-0x0000023308890000-0x00000233088AC000-memory.dmp

Download

memory/2012-2594-0x0000023309C10000-0x0000023309C3E000-memory.dmp

Download

memory/2012-2591-0x0000023309D20000-0x0000023309D96000-memory.dmp

Download

memory/2012-2588-0x0000023309AF0000-0x0000023309B08000-memory.dmp

Download

memory/2012-2585-0x00000233088A0000-0x00000233088A8000-memory.dmp

Download

memory/2012-2582-0x0000023308C80000-0x0000023308C96000-memory.dmp

Download

memory/2012-2579-0x0000023308BF0000-0x0000023308C0C000-memory.dmp

Download

memory/2012-2576-0x0000023309C40000-0x0000023309C9C000-memory.dmp

Download

memory/2012-2573-0x0000023309B70000-0x0000023309BA4000-memory.dmp

Download

memory/2012-2570-0x0000023308AC0000-0x0000023308AD8000-memory.dmp

Download

memory/2012-2567-0x0000023309B30000-0x0000023309B66000-memory.dmp

Download

memory/2012-2563-0x0000023308890000-0x000002330889E000-memory.dmp

Download

memory/2012-2560-0x0000023308C50000-0x0000023308C7A000-memory.dmp

Download

memory/2012-2556-0x0000023307FB0000-0x0000023307FBA000-memory.dmp

Download

memory/2012-2553-0x0000023309AB0000-0x0000023309AE4000-memory.dmp

Download

memory/2012-2549-0x0000023307FA0000-0x0000023307FAA000-memory.dmp

Download

memory/2012-2665-0x0000023308890000-0x000002330889E000-memory.dmp

Download

memory/2096-1590-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/2660-1939-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/2700-1736-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/2888-1737-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/4084-2000-0x0000000000140000-0x00000000001B7000-memory.dmp

Download

memory/4312-2001-0x0000000000140000-0x00000000001B7000-memory.dmp

Download

memory/4376-1734-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/4708-1589-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/4764-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4764-628-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4764-627-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4764-2221-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4764-1502-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4764-1518-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4836-2002-0x0000000000140000-0x00000000001B7000-memory.dmp

Download

memory/4904-1515-0x0000000000280000-0x00000000002DE000-memory.dmp

Download

memory/4904-1521-0x0000000000280000-0x00000000002DE000-memory.dmp

Download

memory/5132-1838-0x0000000000BB0000-0x0000000000C15000-memory.dmp

Download

memory/5588-2170-0x0000000000050000-0x00000000000B5000-memory.dmp

Download

memory/5700-1941-0x00000000005A0000-0x0000000000617000-memory.dmp

Download

memory/5880-2169-0x0000000000050000-0x00000000000B5000-memory.dmp

Download

memory/5964-1517-0x0000000072760000-0x0000000072784000-memory.dmp

Download

memory/5964-1516-0x0000000000280000-0x00000000002DE000-memory.dmp

Download

memory/5964-1522-0x0000000000280000-0x00000000002DE000-memory.dmp

Download