Overview

overview

7

Static

static

3

OMARPERM/O...er.exe

windows10-2004-x64

1

OMARPERM/O...er.exe

windows11-ltsc_2024-x64

1

OMARPERM/�...1).exe

windows10-2004-x64

7

OMARPERM/�...1).exe

windows11-ltsc_2024-x64

7

install_all.bat

windows10-2004-x64

7

install_all.bat

windows11-ltsc_2024-x64

7

vcredist2005_x64.exe

windows10-2004-x64

7

vcredist2005_x64.exe

windows11-ltsc_2024-x64

7

vcredist2005_x86.exe

windows10-2004-x64

7

vcredist2005_x86.exe

windows11-ltsc_2024-x64

7

vcredist2008_x64.exe

windows10-2004-x64

7

vcredist2008_x64.exe

windows11-ltsc_2024-x64

7

vcredist2008_x86.exe

windows10-2004-x64

vcredist2008_x86.exe

windows11-ltsc_2024-x64

vcredist2010_x64.exe

windows10-2004-x64

7

vcredist2010_x64.exe

windows11-ltsc_2024-x64

7

vcredist2010_x86.exe

windows10-2004-x64

7

vcredist2010_x86.exe

windows11-ltsc_2024-x64

7

vcredist2012_x64.exe

windows10-2004-x64

4

vcredist2012_x64.exe

windows11-ltsc_2024-x64

4

vcredist2012_x86.exe

windows10-2004-x64

4

vcredist2012_x86.exe

windows11-ltsc_2024-x64

4

vcredist2013_x64.exe

windows10-2004-x64

4

vcredist2013_x64.exe

windows11-ltsc_2024-x64

4

vcredist2013_x86.exe

windows10-2004-x64

4

vcredist2013_x86.exe

windows11-ltsc_2024-x64

4

vcredist_v14.x64.exe

windows10-2004-x64

4

vcredist_v14.x64.exe

windows11-ltsc_2024-x64

4

vcredist_v14.x86.exe

windows10-2004-x64

4

vcredist_v14.x86.exe

windows11-ltsc_2024-x64

4

OMARPERM/�...1).exe

windows10-2004-x64

6

OMARPERM/�...1).exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/08/2026, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install_all.bat
  • Size 1KB
  • Sample260805-ystcwavepc
  • SHA256 8701f398ce42eb74f726bff81ac489c82d70c6cd1a3a69700af0785fb6c2acf9
  • MD5 SHA1 SHA512 TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 42 IoCs
  • Adds Run key to start application 2 TTPs 27 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 35 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install_all.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe
      vcredist2005_x86.exe /q
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3356
    • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe
      vcredist2005_x64.exe /q
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:4892
    • C:\Users\Admin\AppData\Local\Temp\vcredist2008_x86.exe
      vcredist2008_x86.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3932
      • \??\f:\a52ce983111d04b83e706a792ec7\install.exe
        f:\a52ce983111d04b83e706a792ec7\.\install.exe /qb
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:4896
    • C:\Users\Admin\AppData\Local\Temp\vcredist2008_x64.exe
      vcredist2008_x64.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1784
      • \??\f:\c08bd3dd33a1c71004\install.exe
        f:\c08bd3dd33a1c71004\.\install.exe /qb
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:3088
    • C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.exe
      vcredist2010_x86.exe /passive /norestart
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1292
      • \??\f:\d0e85be5d7f3bba0df\Setup.exe
        f:\d0e85be5d7f3bba0df\Setup.exe /passive /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:756
    • C:\Users\Admin\AppData\Local\Temp\vcredist2010_x64.exe
      vcredist2010_x64.exe /passive /norestart
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4464
      • \??\f:\ea281c27f5997fe2cb0579\Setup.exe
        f:\ea281c27f5997fe2cb0579\Setup.exe /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4628
    • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
      vcredist2012_x86.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{BDC1A765-9174-42AD-8CF3-246E72C81B96} {DCC82470-D7FD-44DE-9590-C288FAF8AD9F} 3056
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:2812
    • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64.exe
      vcredist2012_x64.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{EAF837D3-EC19-4C97-840A-55B639CF5690} {37768C9A-1BED-477C-A36C-EE42AB0C4FCB} 1972
        3⤵
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:5052
    • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86.exe
      vcredist2013_x86.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:412
      • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{1639621C-C8EE-48E6-B79A-8ACD6BC96EFE} {589C3D36-5CAD-4294-B3F8-3717E09E99D8} 412
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:3588
    • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64.exe
      vcredist2013_x64.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{E86E62C5-297B-46A2-A212-9CEED9E279ED} {808D350E-A31F-4FDD-970D-81E4BEA0E176} 2128
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:760
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 1044
          4⤵
          • Program crash
          PID:5012
    • C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x86.exe
      vcredist_v14.x86.exe /passive /norestart
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\Temp\{AD69F578-B15B-43F3-B30B-131D1C2F4701}\.cr\vcredist_v14.x86.exe
        "C:\Windows\Temp\{AD69F578-B15B-43F3-B30B-131D1C2F4701}\.cr\vcredist_v14.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x86.exe" -burn.filehandle.attached=664 -burn.filehandle.self=672 /passive /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4848
        • C:\Windows\Temp\{CA47FB0B-4EF9-453C-87EF-0B35403DA931}\.be\VC_redist.x86.exe
          "C:\Windows\Temp\{CA47FB0B-4EF9-453C-87EF-0B35403DA931}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{565E9397-2350-4AAC-ADAF-D2C3456D0967} {5AF32B03-A3C1-4FAD-85AA-C69D9854377C} 4848
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1068
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1516
          4⤵
          • Program crash
          PID:4396
    • C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x64.exe
      vcredist_v14.x64.exe /passive /norestart
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\Temp\{483917AA-5DDA-4DF7-ACD4-7BD402271661}\.cr\vcredist_v14.x64.exe
        "C:\Windows\Temp\{483917AA-5DDA-4DF7-ACD4-7BD402271661}\.cr\vcredist_v14.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x64.exe" -burn.filehandle.attached=700 -burn.filehandle.self=704 /passive /norestart
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:2964
        • C:\Windows\Temp\{00DB6C97-BE7B-4594-B4DE-E4A219FF2E4B}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{00DB6C97-BE7B-4594-B4DE-E4A219FF2E4B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D4A49888-EEE9-46C7-A843-C502784F3CEE} {A945D436-58D1-462E-BA96-7AA690BD3D2E} 2964
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1508
          4⤵
          • Program crash
          PID:3976
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:468
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 220322E11AF9566969A8358F2E21B4C0
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1868
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F9EB63698C0E6AF108EBB5F54D41BBEC
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4476
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4764
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored /burn.runonce
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored -burn.unelevated BurnPipe.{5A4DFB56-3612-459D-BA8C-F75990A92766} {AE31164E-45E7-4624-851C-001DB1CB0491} 1616
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:2584
  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log" /passive /norestart ignored /burn.runonce
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log /passive /norestart ignored
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log /passive /norestart ignored -burn.unelevated BurnPipe.{177E9305-7CB5-404D-8D79-6BEB98355911} {A0CD6650-469B-43B6-B5A9-904C9B6EAD61} 1612
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:2392
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored /burn.runonce
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{F936BA0B-125C-4792-A653-0235C8BEBE14} {B0B8160D-E2DD-4339-84B2-D1ACEF12FC77} 4896
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:5040
  • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210653.log"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210653.log" -burn.unelevated BurnPipe.{65373EF8-6816-4D4D-B4FC-D175F097437A} {372A6181-E203-4206-82A2-C71F62F2864B} 1172
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:3796
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 904
          4⤵
          • Program crash
          PID:4028
  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log" /passive /norestart ignored ignored /burn.runonce
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log /passive /norestart ignored ignored
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3568
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{478DB109-B8BD-441D-B8E6-333592412FA1} {D4675119-0038-4993-90F6-11F229ACDFB0} 3568
        3⤵
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:5012
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored /burn.runonce
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{C4D8F023-56CD-4225-BB93-B188BF1F2816} {A40978A8-4BF2-40AB-855B-2984655F1506} 1880
        3⤵
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:4780
  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log" /passive /norestart ignored ignored ignored /burn.runonce
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log /passive /norestart ignored ignored ignored
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3252
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210652.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{D6D6C0FA-5AA0-47EF-83BC-2E4C136B57B5} {EABB210E-0544-42DA-B48D-17DBF00248F4} 3252
        3⤵
        • Loads dropped DLL
        PID:3312
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{550BBDAA-93D9-4E4B-88FA-B569F977AA49} {C3D3399B-2C96-46C8-95D4-1CF78684358C} 1304
        3⤵
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:4284
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4008
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{155220F9-7264-4437-A194-F57C029DC2DC} {14BE41E8-6F57-4C89-A6A7-68B3F3A45D68} 4008
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:4940
  • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210659.log"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210659.log" -burn.unelevated BurnPipe.{1F7EE157-A6A2-4342-93CC-993C7B8835C0} {6D4C4766-06B6-4E26-9F33-14C3ADC06090} 1664
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:4404
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9DB26AB9-E07B-41AF-A2C7-E34373EA1D95} {871E1F1B-109A-4748-BFC3-059FF009AB1E} 3552
        3⤵
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:2552
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5B5C8121-287B-4739-BC79-FCC8AD03A596} {9D97FAF2-78CD-410E-874F-4588F3BB4CF6} 4608
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:2812
  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D5885D06-15D4-49C6-AFBD-139B23C2062C} {17CE71C2-9CCF-49DB-9E34-D44BF6524A29} 1756
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:4460
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 760 -ip 760
    1⤵
      PID:860
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3796 -ip 3796
      1⤵
        PID:4968
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4268
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{8CF7E58A-1022-4434-AA92-F53673248B09} {C15D9713-14AC-4632-8A32-49635F289514} 4268
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:2828
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9180E1F0-E7E7-4D89-BB25-DC35E96D434C} {65BFEDDA-91CD-4E1E-8541-14549BF94007} 2752
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:4816
      • C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe
        "C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5008
        • C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe
          "C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210707.log"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe
            "C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe" -burn.filehandle.attached=420 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210707.log"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:2384
            • C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{9a6ce18d-11c0-4452-aa35-9f2b8437c686}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{DD35B2DA-F874-4363-A5E2-DAC647C6AB99} {6CF9F563-47BD-49E4-9770-330EC6B21D4E} 2384
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4808
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3476
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4748
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{26AD9778-DBE3-4068-954D-9D9EE6EDD129} {AB25C723-6050-4B9E-915B-4D71E68FC821} 4748
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:1164
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4848 -ip 4848
        1⤵
          PID:60
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
          1⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
            2⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2268
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{4214A572-91E8-4893-A33D-14F700507B77} {8E74B0BF-08AB-4B2A-95F5-BBD4DB6D4448} 2268
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:4432
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
          1⤵
            PID:3324
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:4412
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{324B5C07-DB9C-4F4E-AEF1-093832519008} {E1CD2252-AC5F-44E1-A8AE-CA4ECEBB7696} 4412
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:976
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3388
            • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210713.log"
              2⤵
              • Executes dropped EXE
              PID:4000
              • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210713.log"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:4936
                • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{900CD42A-531B-4A1C-ADF0-E218EA0EEC14} {BA4962BF-D0A2-45DC-B06E-854DDC88A173} 4936
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:464
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1588
                  4⤵
                  • Program crash
                  PID:3128
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
              PID:4312
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                2⤵
                • Adds Run key to start application
                PID:3012
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{F8555903-939F-4B0D-8EC4-BC445E8F5981} {2CD9DFA9-C05A-4AE7-A261-AC9866836E65} 3012
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  PID:1260
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
              1⤵
                PID:4036
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:3940
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7374AF5D-C8E0-4C0E-83A4-038F3A61B092} {93712EFC-7BE8-406D-97F9-ADE973622FCA} 3940
                    3⤵
                    • Loads dropped DLL
                    PID:1536
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2964 -ip 2964
                1⤵
                  PID:3296
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4936 -ip 4936
                  1⤵
                    PID:4592

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        Windows Command Shell

                        1
                        T1059.003

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Event Triggered Execution

                        1
                        T1546

                        Installer Packages

                        1
                        T1546.016

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Event Triggered Execution

                        1
                        T1546

                        Installer Packages

                        1
                        T1546.016

                        Defense Evasion

                        Modify Registry

                        1
                        T1112

                        System Binary Proxy Execution

                        1
                        T1218

                        Msiexec

                        1
                        T1218.007

                        Credential Access

                        Discovery

                        Peripheral Device Discovery

                        2
                        T1120

                        Query Registry

                        7
                        T1012

                        System Information Discovery

                        7
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        e588ea2.rbs
                        • Path C:\Config.Msi\e588ea2.rbs
                        • Size 73KB
                        • SHA256 4d363a0a04b66e7e87cc5625a30202fbb28786f8af5c94f99ad0702cbdd483f4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ea7.rbs
                        • Path C:\Config.Msi\e588ea7.rbs
                        • Size 73KB
                        • SHA256 9c0f613df94a26907f5c49d88f349498f1637cb0e540f693e097e0d0eb117818
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588eab.rbs
                        • Path C:\Config.Msi\e588eab.rbs
                        • Size 30KB
                        • SHA256 b868806ba8463a49bba9a3a643a5fb681548dda36ec2a9efade4b3042f905ff3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588eaf.rbs
                        • Path C:\Config.Msi\e588eaf.rbs
                        • Size 30KB
                        • SHA256 0e2e72685bd6870793ef5665d71efec0fb231dc54db7374c5d51f53c37448fa8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588eb3.rbs
                        • Path C:\Config.Msi\e588eb3.rbs
                        • Size 4KB
                        • SHA256 9e022d09af123305ee4294e52e083df424fe1ddd3bcdfb020a8ccbf78073ddd4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588eb7.rbs
                        • Path C:\Config.Msi\e588eb7.rbs
                        • Size 31KB
                        • SHA256 3a2c50e424e0278789c2e8d53a1eb9301d22c7fa4067c81ec7a8952a74101d33
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ebb.rbs
                        • Path C:\Config.Msi\e588ebb.rbs
                        • Size 17KB
                        • SHA256 65e3a863cfbf5d0c7c6a021ca4224c33d1c660791c280c58663451dec492a7c3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ec4.rbs
                        • Path C:\Config.Msi\e588ec4.rbs
                        • Size 13KB
                        • SHA256 e1f42afd98eedf36a2a57f765ccb5d6057ef04b0d218a499ed57b76f18b2ecf8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ec5.rbf
                        • Path C:\Config.Msi\e588ec5.rbf
                        • Size 444KB
                        • SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ec6.rbf
                        • Path C:\Config.Msi\e588ec6.rbf
                        • Size 948KB
                        • SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ec7.rbf
                        • Path C:\Config.Msi\e588ec7.rbf
                        • Size 331KB
                        • SHA256 c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ec8.rbf
                        • Path C:\Config.Msi\e588ec8.rbf
                        • Size 242KB
                        • SHA256 1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ec9.rbf
                        • Path C:\Config.Msi\e588ec9.rbf
                        • Size 117KB
                        • SHA256 62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588eca.rbf
                        • Path C:\Config.Msi\e588eca.rbf
                        • Size 3B
                        • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                        • MD5 SHA1 SHA512
                        Submit Download

                        e588ece.rbs
                        • Path C:\Config.Msi\e588ece.rbs
                        • Size 18KB
                        • SHA256 2543eaf6e8f376d13f0364a66c03bd867d5c3ce6a2066b1c47632556d1f60d7d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ed7.rbs
                        • Path C:\Config.Msi\e588ed7.rbs
                        • Size 14KB
                        • SHA256 d358f14f643ce8e423e90dcc4861a9bbead2f35f2002e609b52f3390bdcfa3b5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ed8.rbf
                        • Path C:\Config.Msi\e588ed8.rbf
                        • Size 644KB
                        • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ed9.rbf
                        • Path C:\Config.Msi\e588ed9.rbf
                        • Size 940KB
                        • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588eda.rbf
                        • Path C:\Config.Msi\e588eda.rbf
                        • Size 470KB
                        • SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588edb.rbf
                        • Path C:\Config.Msi\e588edb.rbf
                        • Size 348KB
                        • SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588edc.rbf
                        • Path C:\Config.Msi\e588edc.rbf
                        • Size 134KB
                        • SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ee1.rbs
                        • Path C:\Config.Msi\e588ee1.rbs
                        • Size 26KB
                        • SHA256 6a58459cd1763cd0def8e02aef9383a1337762243b2b11503e9f5e0f3fc11653
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ef3.rbs
                        • Path C:\Config.Msi\e588ef3.rbs
                        • Size 22KB
                        • SHA256 bc2452208f83ab30ec7216aef1110fb15c28c0411d4e87ab2f3f1b0523c498b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ef4.rbf
                        • Path C:\Config.Msi\e588ef4.rbf
                        • Size 45KB
                        • SHA256 5e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ef5.rbf
                        • Path C:\Config.Msi\e588ef5.rbf
                        • Size 45KB
                        • SHA256 9eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ef6.rbf
                        • Path C:\Config.Msi\e588ef6.rbf
                        • Size 73KB
                        • SHA256 550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ef7.rbf
                        • Path C:\Config.Msi\e588ef7.rbf
                        • Size 63KB
                        • SHA256 d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ef8.rbf
                        • Path C:\Config.Msi\e588ef8.rbf
                        • Size 72KB
                        • SHA256 87e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ef9.rbf
                        • Path C:\Config.Msi\e588ef9.rbf
                        • Size 73KB
                        • SHA256 b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588efa.rbf
                        • Path C:\Config.Msi\e588efa.rbf
                        • Size 71KB
                        • SHA256 271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588efb.rbf
                        • Path C:\Config.Msi\e588efb.rbf
                        • Size 52KB
                        • SHA256 43cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588efc.rbf
                        • Path C:\Config.Msi\e588efc.rbf
                        • Size 52KB
                        • SHA256 32dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588efd.rbf
                        • Path C:\Config.Msi\e588efd.rbf
                        • Size 69KB
                        • SHA256 1154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588efe.rbf
                        • Path C:\Config.Msi\e588efe.rbf
                        • Size 4.2MB
                        • SHA256 6130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588eff.rbf
                        • Path C:\Config.Msi\e588eff.rbf
                        • Size 4.2MB
                        • SHA256 68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588f00.rbf
                        • Path C:\Config.Msi\e588f00.rbf
                        • Size 81KB
                        • SHA256 8c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588f01.rbf
                        • Path C:\Config.Msi\e588f01.rbf
                        • Size 81KB
                        • SHA256 d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588f0e.rbs
                        • Path C:\Config.Msi\e588f0e.rbs
                        • Size 19KB
                        • SHA256 29d985f64f9f7ffd1cb58d151fb699dcbedc948cef0c79d377b7a485e9c33cd3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588f1a.rbs
                        • Path C:\Config.Msi\e588f1a.rbs
                        • Size 19KB
                        • SHA256 4687b3b81bca600d5e93fec4d855e7a1ed720b4862514aabb8c4e8d001de7a3e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        state.rsm
                        • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                        • Size 618B
                        • SHA256 e9c480dd9637882b633d1e0b01431d27183b4f94be88d84c7b92c36ff9a342b1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        state.rsm
                        • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm
                        • Size 618B
                        • SHA256 e0cea9d09f0aa00bb707ddf88135c718eea252e9adc689d4e5d33cb15689108c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        vcredis1.cab
                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                        • Size 247KB
                        • SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcredis1.cab
                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                        • Size 312KB
                        • SHA256 20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcredist.msi
                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                        • Size 2.6MB
                        • SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcredist.msi
                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                        • Size 3.0MB
                        • SHA256 200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Setup_20260805_210643440.html
                        • Path C:\Users\Admin\AppData\Local\Temp\Setup_20260805_210643440.html
                        • Size 18KB
                        • SHA256 6a3b8858b6824ac6ff0dd787ebfedfb654ca3ddaf4cb68a7ec023bdc80834995
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VWL22B1.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\VWL22B1.tmp
                        • Size 186B
                        • SHA256 aa6cc8a0163d534630b833a8b5a4fb70d5ddf2da40704df6412a5d18ef943c23
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        dd_vcredistMSI3C85.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3C85.txt
                        • Size 2KB
                        • SHA256 4ee9e2729b61129a157eb9a22a1131e0c8e69014f8ee6cbd8cddc45054049453
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        dd_vcredistMSI3C8F.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3C8F.txt
                        • Size 2KB
                        • SHA256 0df2ac5e9afdc58e4c91147cbd01d7888e0870e3b521de389dbe63b548fa1415
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        dd_vcredist_x86_20260805210651.log
                        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210651.log
                        • Size 23KB
                        • SHA256 cb9c4d2ce2632f61de52d398f7fec284ad01c2bf66ae2b4e7ceb6c2824feae4e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        license.rtf
                        • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
                        • Size 6KB
                        • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wixstdba.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
                        • Size 117KB
                        • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        BootstrapperApplicationData.xml
                        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\BootstrapperApplicationData.xml
                        • Size 3KB
                        • SHA256 ef0085c0476fbe4d6d170c6909f4ad35762fb05e125e9ed707b3c413ae6bbc74
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        license.rtf
                        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\license.rtf
                        • Size 47KB
                        • SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        logo.png
                        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
                        • Size 1KB
                        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        thm.wxl
                        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxl
                        • Size 2KB
                        • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        thm.xml
                        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.xml
                        • Size 5KB
                        • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wixstdba.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
                        • Size 126KB
                        • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        BootstrapperApplicationData.xml
                        • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\BootstrapperApplicationData.xml
                        • Size 3KB
                        • SHA256 ed6e836d0ff4648d8464f7f63d2a8f0a10f6fbcee52a92449580d6f7c0238671
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        MSI98EF.tmp
                        • Path C:\Windows\Installer\MSI98EF.tmp
                        • Size 28KB
                        • SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e588ec1.msi
                        • Path C:\Windows\Installer\e588ec1.msi
                        • Size 140KB
                        • SHA256 60714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        thm.wxl
                        • Path C:\Windows\Temp\{00DB6C97-BE7B-4594-B4DE-E4A219FF2E4B}\.ba\thm.wxl
                        • Size 3KB
                        • SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        thm.xml
                        • Path C:\Windows\Temp\{00DB6C97-BE7B-4594-B4DE-E4A219FF2E4B}\.ba\thm.xml
                        • Size 8KB
                        • SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        wixstdba.dll
                        • Path C:\Windows\Temp\{00DB6C97-BE7B-4594-B4DE-E4A219FF2E4B}\.ba\wixstdba.dll
                        • Size 215KB
                        • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VC_redist.x64.exe
                        • Path C:\Windows\Temp\{00DB6C97-BE7B-4594-B4DE-E4A219FF2E4B}\.be\VC_redist.x64.exe
                        • Size 615KB
                        • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VC_redist.x86.exe
                        • Path C:\Windows\Temp\{CA47FB0B-4EF9-453C-87EF-0B35403DA931}\.be\VC_redist.x86.exe
                        • Size 614KB
                        • SHA256 dd985380ee5288472e68d5e0943cae957729a86588cd8e5d39b97aefd06595c0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.exe
                        • Path F:\a52ce983111d04b83e706a792ec7\install.exe
                        • Size 547KB
                        • SHA256 b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.exe
                        • Path F:\c08bd3dd33a1c71004\install.exe
                        • Size 834KB
                        • SHA256 f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1033.dll
                        • Path F:\c08bd3dd33a1c71004\install.res.1033.dll
                        • Size 84KB
                        • SHA256 6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        metadata-2
                        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                        • Size 24.1MB
                        • SHA256 3aff398eb2afa408e3141a25f0cd6d95d23a7a3eeaa86176989aeea997ebbbf7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        {9fe7e9cf-0e10-470f-a93c-dfc4af94f275}_OnDiskSnapshotProp
                        • Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9fe7e9cf-0e10-470f-a93c-dfc4af94f275}_OnDiskSnapshotProp
                        • Size 6KB
                        • SHA256 ce14231299e07126b95a527e05d12f17bf3075b6860c455b75ecc7ff17e0fb2f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        VC_RED.cab
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\VC_RED.cab
                        • Size 3.7MB
                        • SHA256 461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.1028.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1028.txt
                        • Size 3KB
                        • SHA256 cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        eula.1031.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1031.txt
                        • Size 15KB
                        • SHA256 3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.1033.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1033.txt
                        • Size 9KB
                        • SHA256 c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.1036.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1036.txt
                        • Size 11KB
                        • SHA256 3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.1040.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1040.txt
                        • Size 13KB
                        • SHA256 ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.1041.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1041.txt
                        • Size 5KB
                        • SHA256 467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.1042.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1042.txt
                        • Size 5KB
                        • SHA256 3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.1049.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.1049.txt
                        • Size 13KB
                        • SHA256 f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        eula.2052.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.2052.txt
                        • Size 3KB
                        • SHA256 744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        eula.3082.txt
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\eula.3082.txt
                        • Size 12KB
                        • SHA256 c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        globdata.ini
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\globdata.ini
                        • Size 1KB
                        • SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        install.ini
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.ini
                        • Size 841B
                        • SHA256 c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        install.res.1028.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1028.dll
                        • Size 71KB
                        • SHA256 1074252f76e72e59a9da9d7e109c80ab131d53554c49cb3d69a180729bffc18e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1031.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1031.dll
                        • Size 90KB
                        • SHA256 2c5fa53e6eb07bddc22c7c5203ff7bbe707c4cf8803f144ceb031384b59831aa
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1033.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1033.dll
                        • Size 85KB
                        • SHA256 a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1036.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1036.dll
                        • Size 91KB
                        • SHA256 cb38381c0afdcb3465f71699addad7534ffd72702907b017708eba463dbc68b6
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1040.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1040.dll
                        • Size 89KB
                        • SHA256 709ab0139c643b78c2dace7a35b9801e1a4b4e4c4e176c0d00f1b55a2a71d7a8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1041.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1041.dll
                        • Size 76KB
                        • SHA256 f74006aaa2a19777fb0c3b81321aabf00d87107dc23ba0d2282092502e5cd332
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1042.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1042.dll
                        • Size 74KB
                        • SHA256 16fed8f279b0240f63dd90925150cd37782e9395af32a2693bdc0533c0809767
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1049.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.1049.dll
                        • Size 87KB
                        • SHA256 3de25f7b3fd91a8d5b7f7dd8eccf44e24b33b66133fc89519d21a426b489374e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.2052.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.2052.dll
                        • Size 70KB
                        • SHA256 f6d949f493cb9b1ba5ee053acc7363bc9675b9e8b3f25258080092001036e6f4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.3082.dll
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\install.res.3082.dll
                        • Size 90KB
                        • SHA256 8de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vc_red.msi
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\vc_red.msi
                        • Size 222KB
                        • SHA256 34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vcredist.bmp
                        • Path \??\f:\a52ce983111d04b83e706a792ec7\vcredist.bmp
                        • Size 5KB
                        • SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1028.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.1028.dll
                        • Size 70KB
                        • SHA256 3b603f4847c32f21b4dfc949052ebadb0b191f6caac373e4936e47b27b96cd7a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1031.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.1031.dll
                        • Size 89KB
                        • SHA256 a2b2334a1dcfd2eefdda5a1c357ca0a256c55c92a94f84204f8e2d6ca4e0bd82
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1036.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.1036.dll
                        • Size 90KB
                        • SHA256 87700397b469cb0ea59ae6534370218c42c9b9fba636741612a5300dd72ff530
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1040.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.1040.dll
                        • Size 88KB
                        • SHA256 128b2be768e20129142af7f319cf7a761ead35ff311623d128a7b372033b9122
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1041.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.1041.dll
                        • Size 75KB
                        • SHA256 58a7d64dd55d6057e19c039abb1508920f6a33940f4612ac55a90fb74dfca28a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1042.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.1042.dll
                        • Size 73KB
                        • SHA256 05e79bf81fe87ba3db89950cea02ae78e3b7b1c2d6575f19df47c4f5d7888566
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.1049.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.1049.dll
                        • Size 86KB
                        • SHA256 386f3b2c5b6316963f353cf2bb3dba69ff6e82e2166c010a87813dd54637a49c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.2052.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.2052.dll
                        • Size 69KB
                        • SHA256 8eb88b40484b34fc712fae8a31a5e35042712ae57c9dddefd1e5746d949d5a03
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        install.res.3082.dll
                        • Path \??\f:\c08bd3dd33a1c71004\install.res.3082.dll
                        • Size 89KB
                        • SHA256 847bb5d0992fdbcfb90e00ba66fbe8992926d5d5b9b03f3cf1888ee8af600cf8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        vc_red.msi
                        • Path \??\f:\c08bd3dd33a1c71004\vc_red.msi
                        • Size 230KB
                        • SHA256 017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/1172-914-0x0000000000370000-0x00000000003D5000-memory.dmp
                        Download

                        memory/1172-1255-0x0000000000370000-0x00000000003D5000-memory.dmp
                        Download

                        memory/3796-941-0x0000000000370000-0x00000000003D5000-memory.dmp
                        Download

                        memory/3796-915-0x0000000000370000-0x00000000003D5000-memory.dmp
                        Download