Overview

overview

7

Static

static

3

OMARPERM/O...er.exe

windows10-2004-x64

1

OMARPERM/O...er.exe

windows11-ltsc_2024-x64

1

OMARPERM/�...1).exe

windows10-2004-x64

7

OMARPERM/�...1).exe

windows11-ltsc_2024-x64

7

install_all.bat

windows10-2004-x64

7

install_all.bat

windows11-ltsc_2024-x64

7

vcredist2005_x64.exe

windows10-2004-x64

7

vcredist2005_x64.exe

windows11-ltsc_2024-x64

7

vcredist2005_x86.exe

windows10-2004-x64

7

vcredist2005_x86.exe

windows11-ltsc_2024-x64

7

vcredist2008_x64.exe

windows10-2004-x64

7

vcredist2008_x64.exe

windows11-ltsc_2024-x64

7

vcredist2008_x86.exe

windows10-2004-x64

vcredist2008_x86.exe

windows11-ltsc_2024-x64

vcredist2010_x64.exe

windows10-2004-x64

7

vcredist2010_x64.exe

windows11-ltsc_2024-x64

7

vcredist2010_x86.exe

windows10-2004-x64

7

vcredist2010_x86.exe

windows11-ltsc_2024-x64

7

vcredist2012_x64.exe

windows10-2004-x64

4

vcredist2012_x64.exe

windows11-ltsc_2024-x64

4

vcredist2012_x86.exe

windows10-2004-x64

4

vcredist2012_x86.exe

windows11-ltsc_2024-x64

4

vcredist2013_x64.exe

windows10-2004-x64

4

vcredist2013_x64.exe

windows11-ltsc_2024-x64

4

vcredist2013_x86.exe

windows10-2004-x64

4

vcredist2013_x86.exe

windows11-ltsc_2024-x64

4

vcredist_v14.x64.exe

windows10-2004-x64

4

vcredist_v14.x64.exe

windows11-ltsc_2024-x64

4

vcredist_v14.x86.exe

windows10-2004-x64

4

vcredist_v14.x86.exe

windows11-ltsc_2024-x64

4

OMARPERM/�...1).exe

windows10-2004-x64

6

OMARPERM/�...1).exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install_all.bat
  • Size 1KB
  • Sample260805-ystcwavepc
  • SHA256 8701f398ce42eb74f726bff81ac489c82d70c6cd1a3a69700af0785fb6c2acf9
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 36 IoCs
  • Adds Run key to start application 2 TTPs 23 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 38 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 64 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install_all.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x86.exe
      vcredist2005_x86.exe /q
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4532
    • C:\Users\Admin\AppData\Local\Temp\vcredist2005_x64.exe
      vcredist2005_x64.exe /q
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4576
    • C:\Users\Admin\AppData\Local\Temp\vcredist2008_x86.exe
      vcredist2008_x86.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5936
      • \??\f:\9769796447da26785bfad67ae31adb05\install.exe
        f:\9769796447da26785bfad67ae31adb05\.\install.exe /qb
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:5448
    • C:\Users\Admin\AppData\Local\Temp\vcredist2008_x64.exe
      vcredist2008_x64.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1544
      • \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.exe
        f:\7f07d7e02ffe858bfedfadfcf78d3eac\.\install.exe /qb
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        PID:1916
    • C:\Users\Admin\AppData\Local\Temp\vcredist2010_x86.exe
      vcredist2010_x86.exe /passive /norestart
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1336
      • \??\f:\0324470cb9f253c265e57fef\Setup.exe
        f:\0324470cb9f253c265e57fef\Setup.exe /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3692
    • C:\Users\Admin\AppData\Local\Temp\vcredist2010_x64.exe
      vcredist2010_x64.exe /passive /norestart
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5164
      • \??\f:\c4f4865fb6bd28cc4c699a629f\Setup.exe
        f:\c4f4865fb6bd28cc4c699a629f\Setup.exe /passive /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks system information in the registry
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • System policy modification
        PID:2700
    • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
      vcredist2012_x86.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{394C28E4-C275-44B7-8ADA-A54BDDCF70DA} {5A4FB2E9-6AE9-47C7-883C-0851E94ECABA} 4244
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:4820
    • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64.exe
      vcredist2012_x64.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:6088
      • C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2012_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{B4A6FA8A-8300-49C0-992A-4F61038E3B1E} {9B682EFF-C6F4-4316-ABFD-D50F0D25C712} 6088
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:3716
    • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86.exe
      vcredist2013_x86.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{15591AB8-ED82-4181-A952-305162659B78} {7C57376F-6E9B-40F2-B095-23D228695ED3} 4384
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:5876
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 1260
          4⤵
          • Program crash
          PID:4364
    • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64.exe
      vcredist2013_x64.exe /passive /norestart
      2⤵
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\vcredist2013_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{F94C90A2-6565-43F2-8EFC-896745899CED} {8AB2A559-396C-4304-B40B-17E63D80A98D} 3440
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:1044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 1136
          4⤵
          • Program crash
          PID:3632
    • C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x86.exe
      vcredist_v14.x86.exe /passive /norestart
      2⤵
        PID:1352
        • C:\Windows\Temp\{C4F6F284-FCCB-412F-B44C-ED47CC7C8FD8}\.cr\vcredist_v14.x86.exe
          "C:\Windows\Temp\{C4F6F284-FCCB-412F-B44C-ED47CC7C8FD8}\.cr\vcredist_v14.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x86.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /passive /norestart
          3⤵
            PID:4292
            • C:\Windows\Temp\{2A6EF061-4C30-4258-AC59-462796284838}\.be\VC_redist.x86.exe
              "C:\Windows\Temp\{2A6EF061-4C30-4258-AC59-462796284838}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{DE152D8C-DBC4-4905-B528-051402C05A64} {759419D8-32C1-4418-B2E2-7AE917F5C501} 4292
              4⤵
                PID:5328
          • C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x64.exe
            vcredist_v14.x64.exe /passive /norestart
            2⤵
              PID:3860
              • C:\Windows\Temp\{49DC03EB-584D-480E-AE00-3ABB1ACD899C}\.cr\vcredist_v14.x64.exe
                "C:\Windows\Temp\{49DC03EB-584D-480E-AE00-3ABB1ACD899C}\.cr\vcredist_v14.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist_v14.x64.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /passive /norestart
                3⤵
                  PID:4540
                  • C:\Windows\Temp\{5C403D6A-F6D3-47D1-AA68-3CE8FF64D23B}\.be\VC_redist.x64.exe
                    "C:\Windows\Temp\{5C403D6A-F6D3-47D1-AA68-3CE8FF64D23B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4D688DC0-A68D-4884-96A9-FADA98BCA248} {27C72495-1A2E-4AFA-8E98-C46B0C54EFE7} 4540
                    4⤵
                      PID:4996
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 980
                      4⤵
                      • Program crash
                      PID:5960
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in System32 directory
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1620
                • C:\Windows\system32\srtasks.exe
                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6092
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 4E6475384264398C29818BC7CEBEF5B2
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5940
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding D1CD6C389257AA41A4F354B50B6633BE
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1428
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:4320
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1828
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored
                  2⤵
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:2240
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored -burn.unelevated BurnPipe.{0EF63823-4F05-4D48-A073-8D17649411F6} {2F92CD77-B5CC-4E4A-8EC2-B87F80124D03} 2240
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    PID:1224
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:424
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored
                  2⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2780
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{0A8ED872-E9F5-4573-814B-F404AF7178F9} {437E52E2-FB4C-4140-BD6D-06E77E4D74A9} 2780
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    PID:748
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4136
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored
                  2⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5712
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored -burn.unelevated BurnPipe.{F95C95B1-8C20-45E3-8841-BA92399D9CAA} {D776B080-3814-4232-9F1D-FB8CFD2487D7} 5712
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    PID:5476
              • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /burn.runonce
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3536
                • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210701.log"
                  2⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1528
                  • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210701.log" -burn.unelevated BurnPipe.{C9573588-F97C-4911-AC1D-664A089554B9} {20BC4BCC-2846-4D5F-ABE6-DC158DEDB4C9} 1528
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    PID:2828
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 984
                      4⤵
                      • Program crash
                      PID:4596
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5812
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored
                  2⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5964
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{76015FF4-4E18-4240-922D-8D815141AFC5} {378246F3-4CB5-49BA-8C07-802528C65534} 5964
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    PID:5636
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5040
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored
                  2⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4124
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{089C4C57-2F4F-4E74-B5F3-49227C952AFB} {E6E71DE5-A309-4989-A0E3-51EAFD50BAFD} 4124
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    PID:4416
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5876 -ip 5876
                1⤵
                  PID:4872
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5188
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4820
                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{A50F2740-1ECB-418B-B236-B4474E206DD3} {94F4BE25-E39A-4B01-8E7A-9B0FFF50F5C1} 4820
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:2972
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1772
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:3124
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{5C49E7EF-382E-4F84-98AC-075E35154A67} {56329752-085E-4AF4-9A6A-7FD1E3979C69} 3124
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:4224
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5092
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4856
                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{9EE685B7-4C53-417E-A4AE-AA1EEDC9E00B} {4C40EBC3-40A8-4C7D-B038-B4111E6BCC2D} 4856
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:2672
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2696
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1228
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6A03B842-CC65-4519-8C8B-4FF1166B3B0C} {65B0A0AD-5EE0-4983-B798-84BA24847C24} 1228
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:4720
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5996
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4236
                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6C078991-19C3-4006-997F-BB0D98FEF0A4} {718F696A-4159-45B0-ACF1-5A89D2493A98} 4236
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:4404
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1140
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2416
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{CA9EAD69-2B70-4AAA-BAFF-312655D76CCD} {AF4AF35E-2A1B-4AEB-A270-9E4F61D41146} 2416
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:1636
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4200
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:2540
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A4F3355A-0843-419F-BEAF-7341C009338F} {76E6A8AD-8236-40EA-BA9B-47C01C2DF46C} 2540
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:4968
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:1156
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5428
                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{0B2F9570-6324-4969-836D-A9EBF7474FED} {1D94CF60-B3EA-463D-A0B9-CD507241EEA0} 5428
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:5772
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5752
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4556
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{021F4D90-3D8D-4758-BC64-7F1E67D99D14} {9CDBBF31-16C2-487F-864D-FE93FB0F55C9} 4556
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:4144
                • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
                  1⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2192
                  • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210709.log"
                    2⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4372
                    • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210709.log" -burn.unelevated BurnPipe.{9B9927BE-D3DD-48EB-8DB9-A0F437326B67} {1986D8EC-57B5-489E-B409-5774470FD747} 4372
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3428
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 984
                        4⤵
                        • Program crash
                        PID:1804
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1044 -ip 1044
                  1⤵
                    PID:4800
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                    1⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4216
                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
                      2⤵
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1808
                      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{2B0F2B06-344E-49E0-992C-2D764968CB47} {3BF90AE6-BDBB-4A63-A9E3-42C98E44D625} 1808
                        3⤵
                        • Loads dropped DLL
                        • Suspicious use of FindShellTrayWindow
                        PID:3164
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                    1⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1364
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
                      2⤵
                      • Adds Run key to start application
                      • Suspicious use of WriteProcessMemory
                      PID:6072
                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{17F7E593-AB38-4269-BE47-DADE14CBB67C} {9F22C29A-F9B2-46F4-8D21-938099B0DCD4} 6072
                        3⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        PID:5836
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                    1⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3960
                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1704
                      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5E5C5A43-82F2-4607-89E4-B61871D1533D} {D2E8199B-051D-463F-B70E-33768D73C65E} 1704
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2544
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                    1⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5940
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:3564
                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{8B2A8688-7CB3-4866-8A3F-975076276D0F} {A04FE84E-D1C9-4485-92E1-394D2D98D7CD} 3564
                        3⤵
                          PID:6056
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                      1⤵
                        PID:4252
                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                          2⤵
                            PID:5224
                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{91E67E81-0626-44EF-8BBF-F6EB309AD4C0} {C6765DD0-1965-43C2-8F54-68507B67AFA7} 5224
                              3⤵
                                PID:4072
                          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                            1⤵
                              PID:2088
                              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                2⤵
                                  PID:2904
                                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7F9414C5-E9AA-4ADC-B67D-C2429A365698} {B944FF80-354D-45C1-BC95-368B66C15126} 2904
                                    3⤵
                                      PID:5820
                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                  1⤵
                                    PID:2276
                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                      2⤵
                                        PID:4232
                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5E075736-DDB9-4456-A995-A7C0E30C0316} {907427A1-D6BD-42D7-8616-4EC9EC1EBA67} 4232
                                          3⤵
                                            PID:692
                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                        1⤵
                                          PID:3264
                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                            2⤵
                                              PID:2988
                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{68253B07-D37D-4867-9660-59938D9CD90C} {A5EAA17F-6204-40C9-866C-F93F50FFF936} 2988
                                                3⤵
                                                  PID:2900
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2828 -ip 2828
                                              1⤵
                                                PID:3064
                                              • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
                                                1⤵
                                                  PID:4720
                                                  • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                    "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210719.log"
                                                    2⤵
                                                      PID:984
                                                      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=588 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210719.log"
                                                        3⤵
                                                          PID:1224
                                                          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{664419D4-835F-42FA-834C-70D95FBF13DE} {DDEB3DA2-DFC0-4464-B994-042966C5C951} 1224
                                                            4⤵
                                                              PID:4300
                                                              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{514D31F0-651A-4CD0-BA2C-3B27FBD20BF0} {457EA42D-F5EB-4123-8BEA-4CA02D5B2B61} 4300
                                                                5⤵
                                                                  PID:4752
                                                                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{514D31F0-651A-4CD0-BA2C-3B27FBD20BF0} {457EA42D-F5EB-4123-8BEA-4CA02D5B2B61} 4300
                                                                    6⤵
                                                                      PID:2840
                                                                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                                                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{524CFAE5-98F6-429E-B1ED-E092B1754777} {6D2D9CB2-17BF-48EF-A1AD-FCE84C834BDD} 2840
                                                                        7⤵
                                                                          PID:3136
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4540 -ip 4540
                                                              1⤵
                                                                PID:5568
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3428 -ip 3428
                                                                1⤵
                                                                  PID:4348

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Command and Scripting Interpreter

                                                                      1
                                                                      T1059

                                                                      Windows Command Shell

                                                                      1
                                                                      T1059.003

                                                                      Persistence

                                                                      Boot or Logon Autostart Execution

                                                                      1
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Event Triggered Execution

                                                                      1
                                                                      T1546

                                                                      Installer Packages

                                                                      1
                                                                      T1546.016

                                                                      Privilege Escalation

                                                                      Boot or Logon Autostart Execution

                                                                      1
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Event Triggered Execution

                                                                      1
                                                                      T1546

                                                                      Installer Packages

                                                                      1
                                                                      T1546.016

                                                                      Defense Evasion

                                                                      Modify Registry

                                                                      2
                                                                      T1112

                                                                      System Binary Proxy Execution

                                                                      1
                                                                      T1218

                                                                      Msiexec

                                                                      1
                                                                      T1218.007

                                                                      Credential Access

                                                                      Discovery

                                                                      Peripheral Device Discovery

                                                                      2
                                                                      T1120

                                                                      Query Registry

                                                                      5
                                                                      T1012

                                                                      System Information Discovery

                                                                      4
                                                                      T1082

                                                                      System Location Discovery

                                                                      1
                                                                      T1614

                                                                      System Language Discovery

                                                                      1
                                                                      T1614.001

                                                                      Lateral Movement

                                                                      Collection

                                                                      Command and Control

                                                                      Exfiltration

                                                                      Impact

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      e5a5002.rbs
                                                                      • Path C:\Config.Msi\e5a5002.rbs
                                                                      • Size 30KB
                                                                      • SHA256 0d2dd2898273077a3189804485c4c157de35c4bc54b0ef5a2991d3ae97979467
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5006.rbs
                                                                      • Path C:\Config.Msi\e5a5006.rbs
                                                                      • Size 30KB
                                                                      • SHA256 bd172ef3e9f99b9cc408acd5e0a6824517c37739350f703777342eec15f74809
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a500a.rbs
                                                                      • Path C:\Config.Msi\e5a500a.rbs
                                                                      • Size 4KB
                                                                      • SHA256 d2b2271b3f0cfcad298e2b9eefcb6ef4b7ece419951a4eb862332f66d9443a2b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a500e.rbs
                                                                      • Path C:\Config.Msi\e5a500e.rbs
                                                                      • Size 31KB
                                                                      • SHA256 19bd178037a1f2b5274b8b21a587a979dd0edcedb3e2d33ef51d3ba0d0413c14
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5014.rbs
                                                                      • Path C:\Config.Msi\e5a5014.rbs
                                                                      • Size 17KB
                                                                      • SHA256 dc5a32fff0d0652b4989182b0d29c37a6843832f7bcecf5381f9c3f05db2cf0b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a501d.rbs
                                                                      • Path C:\Config.Msi\e5a501d.rbs
                                                                      • Size 13KB
                                                                      • SHA256 d30615e1c3d633ad66911ceb068813d7ef51e85b2ee9e40369c74d56e33233a7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a501e.rbf
                                                                      • Path C:\Config.Msi\e5a501e.rbf
                                                                      • Size 444KB
                                                                      • SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a501f.rbf
                                                                      • Path C:\Config.Msi\e5a501f.rbf
                                                                      • Size 948KB
                                                                      • SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5020.rbf
                                                                      • Path C:\Config.Msi\e5a5020.rbf
                                                                      • Size 331KB
                                                                      • SHA256 c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5021.rbf
                                                                      • Path C:\Config.Msi\e5a5021.rbf
                                                                      • Size 242KB
                                                                      • SHA256 1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5022.rbf
                                                                      • Path C:\Config.Msi\e5a5022.rbf
                                                                      • Size 117KB
                                                                      • SHA256 62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5023.rbf
                                                                      • Path C:\Config.Msi\e5a5023.rbf
                                                                      • Size 3B
                                                                      • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      e5a5027.rbs
                                                                      • Path C:\Config.Msi\e5a5027.rbs
                                                                      • Size 18KB
                                                                      • SHA256 1ef9e17c9a3507c4b85a90702bf4c4a3a4d51e434a238e2994642eeae808dc23
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5030.rbs
                                                                      • Path C:\Config.Msi\e5a5030.rbs
                                                                      • Size 14KB
                                                                      • SHA256 25cd516bf4bea9a4359283b9dfecf6446507d054a7a2022978ae6e146f5e9ee8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5031.rbf
                                                                      • Path C:\Config.Msi\e5a5031.rbf
                                                                      • Size 644KB
                                                                      • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5032.rbf
                                                                      • Path C:\Config.Msi\e5a5032.rbf
                                                                      • Size 940KB
                                                                      • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5033.rbf
                                                                      • Path C:\Config.Msi\e5a5033.rbf
                                                                      • Size 470KB
                                                                      • SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5034.rbf
                                                                      • Path C:\Config.Msi\e5a5034.rbf
                                                                      • Size 348KB
                                                                      • SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5035.rbf
                                                                      • Path C:\Config.Msi\e5a5035.rbf
                                                                      • Size 134KB
                                                                      • SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a503c.rbs
                                                                      • Path C:\Config.Msi\e5a503c.rbs
                                                                      • Size 19KB
                                                                      • SHA256 41126e2b2ad040f35d25444a05a827b4a8d7f1be81df0d1cc8921a2b4014e18f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a5048.rbs
                                                                      • Path C:\Config.Msi\e5a5048.rbs
                                                                      • Size 19KB
                                                                      • SHA256 10b2ffb0a65d210e674b2046852ba9d722e7da94b4469b08e0ed99cc62816cf8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a504f.rbs
                                                                      • Path C:\Config.Msi\e5a504f.rbs
                                                                      • Size 21KB
                                                                      • SHA256 44a922db2290e99781bed811ac68730b85c4be2b8ef266e1a0d5c827987b1370
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a505e.rbs
                                                                      • Path C:\Config.Msi\e5a505e.rbs
                                                                      • Size 21KB
                                                                      • SHA256 7512986b5a1752ea737c55d93d4bf9075611ffa2cc453391d37c319e7b3083a2
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      state.rsm
                                                                      • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                                                      • Size 618B
                                                                      • SHA256 681e5d2538121181b115f90693cfedccc860571ca0e58277d2997ff73c021fbe
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      state.rsm
                                                                      • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm
                                                                      • Size 618B
                                                                      • SHA256 79dc343efa7b82b59c16a2a2cee6b6f1d46f28455a78e9b8cf95c5c163df1492
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      vcredis1.cab
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                                                      • Size 247KB
                                                                      • SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcredis1.cab
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                                                      • Size 312KB
                                                                      • SHA256 20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcredist.msi
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                                                      • Size 2.6MB
                                                                      • SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcredist.msi
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                                                      • Size 3.0MB
                                                                      • SHA256 200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Setup_20260805_210651647.html
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Setup_20260805_210651647.html
                                                                      • Size 16KB
                                                                      • SHA256 65603c9d63a289fa4baeb319d39fb6216de369f795addab1f83ade37b86a5398
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VWLF687.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\VWLF687.tmp
                                                                      • Size 392B
                                                                      • SHA256 0da194757affc2af5f2698ac5dc0e4713584da5a37d4121e96a90c56be187db8
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      VWLFF41.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\VWLFF41.tmp
                                                                      • Size 392B
                                                                      • SHA256 944a92fa0c902b72ca2b325d8fe7a7d6bd024183249010cf752e697a1e40eacb
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      dd_vcredistMSI3CA2.txt
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3CA2.txt
                                                                      • Size 2KB
                                                                      • SHA256 146394aabfee7b85383f9f870fa559cb69c6b448a00751dece2c111dd231c8e0
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      dd_vcredistMSI3CAC.txt
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3CAC.txt
                                                                      • Size 2KB
                                                                      • SHA256 f5a530b4309b802b14f8bc0fd4e9c7746eed5ca55255dc0b0fa13baa5721a205
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      dd_vcredist_amd64_20260805210700.log
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260805210700.log
                                                                      • Size 23KB
                                                                      • SHA256 b2bbf3e3aec3ed30ac41a85909e44a0a8e33ad3b2e3da51bb80cb0fabd7ae64a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      dd_vcredist_x86_20260805210659.log
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260805210659.log
                                                                      • Size 23KB
                                                                      • SHA256 c06988aa1d158a60075641c673a47c9747e0070658ff3c191f4e6be9dd81bd58
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      license.rtf
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
                                                                      • Size 6KB
                                                                      • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      wixstdba.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\wixstdba.dll
                                                                      • Size 117KB
                                                                      • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      BootstrapperApplicationData.xml
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\BootstrapperApplicationData.xml
                                                                      • Size 3KB
                                                                      • SHA256 ef0085c0476fbe4d6d170c6909f4ad35762fb05e125e9ed707b3c413ae6bbc74
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      logo.png
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
                                                                      • Size 1KB
                                                                      • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      BootstrapperApplicationData.xml
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\BootstrapperApplicationData.xml
                                                                      • Size 3KB
                                                                      • SHA256 ed6e836d0ff4648d8464f7f63d2a8f0a10f6fbcee52a92449580d6f7c0238671
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      license.rtf
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\license.rtf
                                                                      • Size 47KB
                                                                      • SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\thm.wxl
                                                                      • Size 2KB
                                                                      • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.xml
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\thm.xml
                                                                      • Size 5KB
                                                                      • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      wixstdba.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\wixstdba.dll
                                                                      • Size 126KB
                                                                      • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      MSI5D44.tmp
                                                                      • Path C:\Windows\Installer\MSI5D44.tmp
                                                                      • Size 28KB
                                                                      • SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a501a.msi
                                                                      • Path C:\Windows\Installer\e5a501a.msi
                                                                      • Size 140KB
                                                                      • SHA256 60714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VC_redist.x86.exe
                                                                      • Path C:\Windows\Temp\{2A6EF061-4C30-4258-AC59-462796284838}\.be\VC_redist.x86.exe
                                                                      • Size 614KB
                                                                      • SHA256 dd985380ee5288472e68d5e0943cae957729a86588cd8e5d39b97aefd06595c0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      wixstdba.dll
                                                                      • Path C:\Windows\Temp\{5C403D6A-F6D3-47D1-AA68-3CE8FF64D23B}\.ba\wixstdba.dll
                                                                      • Size 215KB
                                                                      • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VC_redist.x64.exe
                                                                      • Path C:\Windows\Temp\{5C403D6A-F6D3-47D1-AA68-3CE8FF64D23B}\.be\VC_redist.x64.exe
                                                                      • Size 615KB
                                                                      • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{65F765F1-6E4C-4711-8239-3F23C39BD43A}\.ba\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.xml
                                                                      • Path C:\Windows\Temp\{65F765F1-6E4C-4711-8239-3F23C39BD43A}\.ba\thm.xml
                                                                      • Size 8KB
                                                                      • SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.exe
                                                                      • Path F:\7f07d7e02ffe858bfedfadfcf78d3eac\install.exe
                                                                      • Size 834KB
                                                                      • SHA256 f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.exe
                                                                      • Path F:\9769796447da26785bfad67ae31adb05\install.exe
                                                                      • Size 547KB
                                                                      • SHA256 b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Setup.exe
                                                                      • Path F:\c4f4865fb6bd28cc4c699a629f\Setup.exe
                                                                      • Size 76KB
                                                                      • SHA256 531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      metadata-2
                                                                      • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                      • Size 26.1MB
                                                                      • SHA256 ae5a2cb6647c816c776f61568d79e5a7ca9bef2c6353e79d05dfd2041e870402
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      {b1a8ab63-b62c-4100-8819-7ec8009fd0d8}_OnDiskSnapshotProp
                                                                      • Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b1a8ab63-b62c-4100-8819-7ec8009fd0d8}_OnDiskSnapshotProp
                                                                      • Size 6KB
                                                                      • SHA256 6571109cbf0b54a968a2c9a5554e5542c162f56f08483d35183233b58ebe083e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1028.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1028.dll
                                                                      • Size 70KB
                                                                      • SHA256 3b603f4847c32f21b4dfc949052ebadb0b191f6caac373e4936e47b27b96cd7a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1031.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1031.dll
                                                                      • Size 89KB
                                                                      • SHA256 a2b2334a1dcfd2eefdda5a1c357ca0a256c55c92a94f84204f8e2d6ca4e0bd82
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1033.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1033.dll
                                                                      • Size 84KB
                                                                      • SHA256 6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1036.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1036.dll
                                                                      • Size 90KB
                                                                      • SHA256 87700397b469cb0ea59ae6534370218c42c9b9fba636741612a5300dd72ff530
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1040.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1040.dll
                                                                      • Size 88KB
                                                                      • SHA256 128b2be768e20129142af7f319cf7a761ead35ff311623d128a7b372033b9122
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1041.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1041.dll
                                                                      • Size 75KB
                                                                      • SHA256 58a7d64dd55d6057e19c039abb1508920f6a33940f4612ac55a90fb74dfca28a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1042.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1042.dll
                                                                      • Size 73KB
                                                                      • SHA256 05e79bf81fe87ba3db89950cea02ae78e3b7b1c2d6575f19df47c4f5d7888566
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1049.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.1049.dll
                                                                      • Size 86KB
                                                                      • SHA256 386f3b2c5b6316963f353cf2bb3dba69ff6e82e2166c010a87813dd54637a49c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.2052.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.2052.dll
                                                                      • Size 69KB
                                                                      • SHA256 8eb88b40484b34fc712fae8a31a5e35042712ae57c9dddefd1e5746d949d5a03
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.3082.dll
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\install.res.3082.dll
                                                                      • Size 89KB
                                                                      • SHA256 847bb5d0992fdbcfb90e00ba66fbe8992926d5d5b9b03f3cf1888ee8af600cf8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vc_red.msi
                                                                      • Path \??\f:\7f07d7e02ffe858bfedfadfcf78d3eac\vc_red.msi
                                                                      • Size 230KB
                                                                      • SHA256 017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VC_RED.cab
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\VC_RED.cab
                                                                      • Size 3.7MB
                                                                      • SHA256 461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.1028.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1028.txt
                                                                      • Size 3KB
                                                                      • SHA256 cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      eula.1031.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1031.txt
                                                                      • Size 15KB
                                                                      • SHA256 3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.1033.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1033.txt
                                                                      • Size 9KB
                                                                      • SHA256 c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.1036.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1036.txt
                                                                      • Size 11KB
                                                                      • SHA256 3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.1040.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1040.txt
                                                                      • Size 13KB
                                                                      • SHA256 ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.1041.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1041.txt
                                                                      • Size 5KB
                                                                      • SHA256 467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.1042.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1042.txt
                                                                      • Size 5KB
                                                                      • SHA256 3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.1049.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.1049.txt
                                                                      • Size 13KB
                                                                      • SHA256 f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      eula.2052.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.2052.txt
                                                                      • Size 3KB
                                                                      • SHA256 744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      eula.3082.txt
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\eula.3082.txt
                                                                      • Size 12KB
                                                                      • SHA256 c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      globdata.ini
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\globdata.ini
                                                                      • Size 1KB
                                                                      • SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      install.ini
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.ini
                                                                      • Size 841B
                                                                      • SHA256 c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      install.res.1028.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1028.dll
                                                                      • Size 71KB
                                                                      • SHA256 1074252f76e72e59a9da9d7e109c80ab131d53554c49cb3d69a180729bffc18e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1031.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1031.dll
                                                                      • Size 90KB
                                                                      • SHA256 2c5fa53e6eb07bddc22c7c5203ff7bbe707c4cf8803f144ceb031384b59831aa
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1033.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1033.dll
                                                                      • Size 85KB
                                                                      • SHA256 a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1036.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1036.dll
                                                                      • Size 91KB
                                                                      • SHA256 cb38381c0afdcb3465f71699addad7534ffd72702907b017708eba463dbc68b6
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1040.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1040.dll
                                                                      • Size 89KB
                                                                      • SHA256 709ab0139c643b78c2dace7a35b9801e1a4b4e4c4e176c0d00f1b55a2a71d7a8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1041.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1041.dll
                                                                      • Size 76KB
                                                                      • SHA256 f74006aaa2a19777fb0c3b81321aabf00d87107dc23ba0d2282092502e5cd332
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1042.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1042.dll
                                                                      • Size 74KB
                                                                      • SHA256 16fed8f279b0240f63dd90925150cd37782e9395af32a2693bdc0533c0809767
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.1049.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.1049.dll
                                                                      • Size 87KB
                                                                      • SHA256 3de25f7b3fd91a8d5b7f7dd8eccf44e24b33b66133fc89519d21a426b489374e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.2052.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.2052.dll
                                                                      • Size 70KB
                                                                      • SHA256 f6d949f493cb9b1ba5ee053acc7363bc9675b9e8b3f25258080092001036e6f4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      install.res.3082.dll
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\install.res.3082.dll
                                                                      • Size 90KB
                                                                      • SHA256 8de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vc_red.msi
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\vc_red.msi
                                                                      • Size 222KB
                                                                      • SHA256 34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcredist.bmp
                                                                      • Path \??\f:\9769796447da26785bfad67ae31adb05\vcredist.bmp
                                                                      • Size 5KB
                                                                      • SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      memory/2840-1368-0x00000000009D0000-0x0000000000A47000-memory.dmp
                                                                      Download

                                                                      memory/3136-1366-0x00000000009D0000-0x0000000000A47000-memory.dmp
                                                                      Download

                                                                      memory/4752-1369-0x00000000009D0000-0x0000000000A47000-memory.dmp
                                                                      Download