3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23

Analysis

max time kernel
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_CommonRedist/VisualCppRedist_AIO_x86_x64.exe
Size 30.1MB
Sample260806-cb476a1elb
SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
MD5 1a7523d92b573859df4cbe8e75509b9e
SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
TLSH
T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence ransomware

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
4280	vcredist_x86.exe
1736	vcredist_x64.exe
5508	vcredist_x86.exe
5060	vcredist_x64.exe
5888	VC_redist.x86.exe
2640	VC_redist.x64.exe
5316	vcredist_x86.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
2100	vcredist_x64.exe
2380	MsiExec.exe
2380	MsiExec.exe
2380	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
1320	VC_redist.x86.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
3184	MsiExec.exe
5400	MsiExec.exe
3380	MsiExec.exe
476	VC_redist.x64.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
868	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe
4184	MsiExec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110rus.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
1952	cscript.exe
4356	cscript.exe
2764	cscript.exe
3764	cscript.exe
5764	cscript.exe
2700	cscript.exe
4960	cscript.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_atl100_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b0b71.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF53978A8FABD01FCB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI379E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E23.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4492.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100deu_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\CacheSize.txt	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727178.0\mfc80ITA.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727359.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2971852B1C1ECE6C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E03.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF55F790286B71A3BA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45CF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B16.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C94.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5DEC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61F8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB503EA1EE00076EC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C61.tmp	msiexec.exe
File created	C:\Windows\dd_vcredist_amd64_000_vcRuntimeMinimum_x64.log	vcredist_x64.exe
File opened for modification	C:\Windows\Installer\MSI44A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FD3.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100ita_x64	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100rus_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6AFF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5452E0D228F5BE3C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65D7183D6FC467F6.TMP	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100cht_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_vcomp100_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727058.0\msvcr80.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260806030727058.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260806030727251.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260806030727359.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD4B99553011FED78.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5ADB3B84E940DE1A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7D2EBE96174B090E.TMP	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\15fa8.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4C8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FF3.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727116.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.manifest	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260806030727116.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DF21D661DAB9C5C2E4.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfcm100u_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6345.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DAF.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727058.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_76a71f32.manifest	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDF8B90CE7CBFA81E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA0EBED43B5927DBE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3928.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4433.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B75.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9A30.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727178.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727303.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\SystemTemp\~DF57E621716741FC53.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A36.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_vcomp100_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260806030727319.0\8.0.50727.6229.cat	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100enu_x64	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260806030727178.0	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4260	cmd.exe
1172	cmd.exe
2360	cmd.exe
4604	cmd.exe
3972	cmd.exe
2884	cmd.exe
5572	cmd.exe
4648	cmd.exe
2764	cmd.exe
2752	cmd.exe
5548	cmd.exe
5892	cmd.exe
3364	cmd.exe
3244	cmd.exe
5252	cmd.exe
2012	cmd.exe
4768	cmd.exe
2840	cmd.exe
1728	cmd.exe
3092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualCppRedist_AIO_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X86,X86,14.30,BUNDLE\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V12\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.OpenMP,type="win32",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007a0050005400310026006e0073004b0064007a00650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.MFC,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00240062003000290043004b0076003d0035002700650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\6 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\9 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2005\\x64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\10 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F603C2ED760AFE838BC630EDB430219F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A2D1F4F1AD9DFC2399908484D50AD65D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Media	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
2736	reg.exe
4968	reg.exe
2872	reg.exe
5316	reg.exe
932	reg.exe
5316	reg.exe
4756	reg.exe
1556	reg.exe
544	reg.exe
2096	reg.exe
1412	reg.exe
712	reg.exe
3340	reg.exe
4724	reg.exe
564	reg.exe
5508	reg.exe
3284	reg.exe
4968	reg.exe
2944	reg.exe
4392	reg.exe
3200	reg.exe
4208	reg.exe
5400	reg.exe
4780	reg.exe
4408	reg.exe
4200	reg.exe
4180	reg.exe
3608	reg.exe
4848	reg.exe
5832	reg.exe
5212	reg.exe
4396	reg.exe
2500	reg.exe
2620	reg.exe
2840	reg.exe
5220	reg.exe
2832	reg.exe
1064	reg.exe
5308	reg.exe
1832	reg.exe
4696	reg.exe
3036	reg.exe
2688	reg.exe
832	reg.exe
5224	reg.exe
4484	reg.exe
1612	reg.exe
5836	reg.exe
4276	reg.exe
5084	reg.exe
1428	reg.exe
4668	reg.exe
3476	reg.exe
5212	reg.exe
2252	reg.exe
716	reg.exe
4852	reg.exe
2208	reg.exe
1040	reg.exe
2496	reg.exe
5488	reg.exe
4592	reg.exe
1204	reg.exe
4536	reg.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
5400	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe
5400	WMIC.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe
3800	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5400	WMIC.exe
Token: SeSecurityPrivilege	5400	WMIC.exe
Token: SeTakeOwnershipPrivilege	5400	WMIC.exe
Token: SeLoadDriverPrivilege	5400	WMIC.exe
Token: SeSystemProfilePrivilege	5400	WMIC.exe
Token: SeSystemtimePrivilege	5400	WMIC.exe
Token: SeProfSingleProcessPrivilege	5400	WMIC.exe
Token: SeIncBasePriorityPrivilege	5400	WMIC.exe
Token: SeCreatePagefilePrivilege	5400	WMIC.exe
Token: SeBackupPrivilege	5400	WMIC.exe
Token: SeRestorePrivilege	5400	WMIC.exe
Token: SeShutdownPrivilege	5400	WMIC.exe
Token: SeDebugPrivilege	5400	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5400	WMIC.exe
Token: SeRemoteShutdownPrivilege	5400	WMIC.exe
Token: SeUndockPrivilege	5400	WMIC.exe
Token: SeManageVolumePrivilege	5400	WMIC.exe
Token: 33	5400	WMIC.exe
Token: 34	5400	WMIC.exe
Token: 35	5400	WMIC.exe
Token: 36	5400	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5400	WMIC.exe
Token: SeSecurityPrivilege	5400	WMIC.exe
Token: SeTakeOwnershipPrivilege	5400	WMIC.exe
Token: SeLoadDriverPrivilege	5400	WMIC.exe
Token: SeSystemProfilePrivilege	5400	WMIC.exe
Token: SeSystemtimePrivilege	5400	WMIC.exe
Token: SeProfSingleProcessPrivilege	5400	WMIC.exe
Token: SeIncBasePriorityPrivilege	5400	WMIC.exe
Token: SeCreatePagefilePrivilege	5400	WMIC.exe
Token: SeBackupPrivilege	5400	WMIC.exe
Token: SeRestorePrivilege	5400	WMIC.exe
Token: SeShutdownPrivilege	5400	WMIC.exe
Token: SeDebugPrivilege	5400	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5400	WMIC.exe
Token: SeRemoteShutdownPrivilege	5400	WMIC.exe
Token: SeUndockPrivilege	5400	WMIC.exe
Token: SeManageVolumePrivilege	5400	WMIC.exe
Token: 33	5400	WMIC.exe
Token: 34	5400	WMIC.exe
Token: 35	5400	WMIC.exe
Token: 36	5400	WMIC.exe
Token: SeBackupPrivilege	1888	vssvc.exe
Token: SeRestorePrivilege	1888	vssvc.exe
Token: SeAuditPrivilege	1888	vssvc.exe
Token: SeBackupPrivilege	772	srtasks.exe
Token: SeRestorePrivilege	772	srtasks.exe
Token: SeSecurityPrivilege	772	srtasks.exe
Token: SeTakeOwnershipPrivilege	772	srtasks.exe
Token: SeShutdownPrivilege	2996	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	2996	vcredist_x86.exe
Token: SeSecurityPrivilege	3800	msiexec.exe
Token: SeCreateTokenPrivilege	2996	vcredist_x86.exe
Token: SeAssignPrimaryTokenPrivilege	2996	vcredist_x86.exe
Token: SeLockMemoryPrivilege	2996	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	2996	vcredist_x86.exe
Token: SeMachineAccountPrivilege	2996	vcredist_x86.exe
Token: SeTcbPrivilege	2996	vcredist_x86.exe
Token: SeSecurityPrivilege	2996	vcredist_x86.exe
Token: SeTakeOwnershipPrivilege	2996	vcredist_x86.exe
Token: SeLoadDriverPrivilege	2996	vcredist_x86.exe
Token: SeSystemProfilePrivilege	2996	vcredist_x86.exe
Token: SeSystemtimePrivilege	2996	vcredist_x86.exe
Token: SeProfSingleProcessPrivilege	2996	vcredist_x86.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4232	VisualCppRedist_AIO_x86_x64.exe
4280	vcredist_x86.exe
1736	vcredist_x64.exe
5508	vcredist_x86.exe
5060	vcredist_x64.exe
5888	VC_redist.x86.exe
2640	VC_redist.x64.exe
5316	vcredist_x86.exe
5524	msiexec.exe
2100	vcredist_x64.exe
5524	msiexec.exe
5828	msiexec.exe
1320	VC_redist.x86.exe
5828	msiexec.exe
3224	msiexec.exe
3224	msiexec.exe
5832	msiexec.exe
5832	msiexec.exe
476	VC_redist.x64.exe
3436	msiexec.exe
3436	msiexec.exe
5596	msiexec.exe
5596	msiexec.exe
1052	msiexec.exe
1052	msiexec.exe
6060	msiexec.exe
6060	msiexec.exe
3220	msiexec.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
3800	msiexec.exe
5524	msiexec.exe
2380	MsiExec.exe
5828	msiexec.exe
3184	MsiExec.exe
3224	msiexec.exe
5400	MsiExec.exe
5832	msiexec.exe
3380	MsiExec.exe
3436	msiexec.exe
868	MsiExec.exe
5596	msiexec.exe
4184	MsiExec.exe
1052	msiexec.exe
4576	MsiExec.exe
6060	msiexec.exe
5844	MsiExec.exe
3220	msiexec.exe
2648	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2752	4232	VisualCppRedist_AIO_x86_x64.exe	88
PID 2752 wrote to memory of 5252	2752	cmd.exe	90
PID 5252 wrote to memory of 4820	5252	cmd.exe	91
PID 2752 wrote to memory of 2532	2752	cmd.exe	92
PID 2752 wrote to memory of 1672	2752	cmd.exe	93
PID 2752 wrote to memory of 2012	2752	cmd.exe	94
PID 2752 wrote to memory of 3936	2752	cmd.exe	95
PID 2752 wrote to memory of 5400	2752	cmd.exe	96
PID 2752 wrote to memory of 2632	2752	cmd.exe	97
PID 2752 wrote to memory of 5548	2752	cmd.exe	99
PID 5548 wrote to memory of 3804	5548	cmd.exe	100
PID 2752 wrote to memory of 4768	2752	cmd.exe	101
PID 4768 wrote to memory of 476	4768	cmd.exe	102
PID 2752 wrote to memory of 1172	2752	cmd.exe	103
PID 1172 wrote to memory of 4120	1172	cmd.exe	104
PID 2752 wrote to memory of 5108	2752	cmd.exe	105
PID 2752 wrote to memory of 4816	2752	cmd.exe	106
PID 2752 wrote to memory of 5492	2752	cmd.exe	107
PID 2752 wrote to memory of 3920	2752	cmd.exe	108
PID 2752 wrote to memory of 2360	2752	cmd.exe	109
PID 2360 wrote to memory of 1952	2360	cmd.exe	110
PID 2752 wrote to memory of 2840	2752	cmd.exe	111
PID 2752 wrote to memory of 4604	2752	cmd.exe	112
PID 4604 wrote to memory of 4356	4604	cmd.exe	113
PID 2752 wrote to memory of 3972	2752	cmd.exe	114
PID 2752 wrote to memory of 1728	2752	cmd.exe	115
PID 1728 wrote to memory of 2764	1728	cmd.exe	116
PID 2752 wrote to memory of 2884	2752	cmd.exe	117
PID 2752 wrote to memory of 3092	2752	cmd.exe	118
PID 3092 wrote to memory of 3764	3092	cmd.exe	119
PID 2752 wrote to memory of 5572	2752	cmd.exe	120
PID 2752 wrote to memory of 4308	2752	cmd.exe	121
PID 2752 wrote to memory of 1612	2752	cmd.exe	122
PID 2752 wrote to memory of 2968	2752	cmd.exe	123
PID 2752 wrote to memory of 3876	2752	cmd.exe	124
PID 2752 wrote to memory of 2100	2752	cmd.exe	125
PID 2752 wrote to memory of 5124	2752	cmd.exe	126
PID 2752 wrote to memory of 4964	2752	cmd.exe	127
PID 2752 wrote to memory of 3000	2752	cmd.exe	128
PID 2752 wrote to memory of 4592	2752	cmd.exe	129
PID 2752 wrote to memory of 3340	2752	cmd.exe	130
PID 2752 wrote to memory of 4724	2752	cmd.exe	131
PID 2752 wrote to memory of 2092	2752	cmd.exe	132
PID 2752 wrote to memory of 4696	2752	cmd.exe	133
PID 2752 wrote to memory of 6048	2752	cmd.exe	134
PID 2752 wrote to memory of 5100	2752	cmd.exe	135
PID 2752 wrote to memory of 2140	2752	cmd.exe	136
PID 2752 wrote to memory of 5836	2752	cmd.exe	137
PID 2752 wrote to memory of 3036	2752	cmd.exe	138
PID 2752 wrote to memory of 4560	2752	cmd.exe	139
PID 2752 wrote to memory of 4276	2752	cmd.exe	140
PID 2752 wrote to memory of 2688	2752	cmd.exe	141
PID 2752 wrote to memory of 5052	2752	cmd.exe	142
PID 2752 wrote to memory of 2196	2752	cmd.exe	143
PID 2752 wrote to memory of 3108	2752	cmd.exe	144
PID 2752 wrote to memory of 3608	2752	cmd.exe	145
PID 2752 wrote to memory of 2160	2752	cmd.exe	146
PID 2752 wrote to memory of 2416	2752	cmd.exe	147
PID 2752 wrote to memory of 1204	2752	cmd.exe	148
PID 2752 wrote to memory of 2880	2752	cmd.exe	149
PID 2752 wrote to memory of 2932	2752	cmd.exe	150
PID 2752 wrote to memory of 4536	2752	cmd.exe	151
PID 2752 wrote to memory of 3944	2752	cmd.exe	152
PID 2752 wrote to memory of 4524	2752	cmd.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\_CommonRedist\VisualCppRedist_AIO_x86_x64.exe
"C:\Users\Admin\AppData\Local\Temp\_CommonRedist\VisualCppRedist_AIO_x86_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2012
- - C:\Windows\system32\reg.exe
    reg.exe query "HKU\S-1-5-19"
    3⤵
    PID:3936
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:4120
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:5108
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:4816
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:5492
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 50.35719.0
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2100
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:3000
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4592
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3340
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
    3⤵
    - Modifies registry key
    PID:4724
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:2092
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4696
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
    3⤵
    PID:6048
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:5100
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    PID:2140
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5836
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3036
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
    3⤵
    PID:4560
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4276
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2688
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    PID:5052
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2196
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3108
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3608
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2160
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2416
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1204
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2880
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2932
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4536
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3944
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4524
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:544
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3952
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2792
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    PID:5632
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2952
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5096
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:716
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5812
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5016
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    PID:5180
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2124
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5104
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    PID:1280
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4344
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5720
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:832
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1736
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3848
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:5084
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1556
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:896
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4852
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4732
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:616
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4392
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3568
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2252
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5224
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4924
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4360
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:564
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2852
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2568
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4848
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4512
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1432
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:712
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5088
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5948
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5508
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:792
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4760
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    PID:3080
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1444
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3048
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3284
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1332
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4904
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4968
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1792
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1440
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    PID:4920
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1484
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2260
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    PID:4888
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3128
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1764
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    PID:4764
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5404
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:612
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5316
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1832
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4916
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5832
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3700
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5056
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    PID:3332
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5220
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4376
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    PID:2264
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3936
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    PID:3856
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4544
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5060
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    PID:1304
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:476
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3244
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5212
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:6100
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4816
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    PID:3372
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2460
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5596
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2840
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:932
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1636
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3200
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4780
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2700
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:4652
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1356
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{14493D4B-F432-4DB4-AE9B-F922ABA64EEC} {E1C770B6-9052-4A7E-8A5F-6805D77FACCD} 1356
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4280
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    PID:5720
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{0E8A1894-FB9B-4885-A01F-DC2058837641} {93C43627-ECB5-4A40-A5D7-20A9FAFB55B4} 5476
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1736
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:4208
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{2AB0AFA4-F6DC-4F6A-A989-8EF146D21757} {59DE90D3-38AB-4AC2-B7AC-DFC3E63F24CD} 2996
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5508
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    - Modifies registry key
    PID:5400
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3804
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{8E9465D3-045E-47F6-BE31-3AC34D65AB41} {EEDA430E-3571-4B45-A118-3F85A5A0048A} 3804
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5060
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    - Modifies registry key
    PID:4396
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5888
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{66B627C6-9AA6-47F4-A395-96EE1A632665} {1A97EC75-1CE8-4D37-94F3-FB7B40D43249} 5888
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4124
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:1428
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=588 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2640
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B39D867F-C199-4E1A-BE1B-D3A16EB4355C} {E21FFB49-D409-4D12-A7B0-141C5D49ECCE} 2640
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2096
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    - Modifies registry key
    PID:932
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:2700
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    PID:2764
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5524
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    - Modifies registry key
    PID:4668
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3476
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5828
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    - Modifies registry key
    PID:2736
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5220
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3224
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
    3⤵
    - Modifies registry key
    PID:5316
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5212
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5832
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
    3⤵
    PID:3360
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
    3⤵
    PID:4440
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4484
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2944
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5892
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4968
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
    3⤵
    - Modifies registry key
    PID:2832
- - C:\Windows\system32\find.exe
    find /i "TRIN_TRIR_SETUP"
    3⤵
    PID:4076
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:824
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3364
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3244
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2904
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3316
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:436
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
    3⤵
    PID:3512
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2872
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
    3⤵
    - Modifies registry key
    PID:4756
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:3328
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4408
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
    3⤵
    PID:1480
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:4204
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    PID:4300
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
    3⤵
    PID:5720
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1612
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1412
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString
    3⤵
    PID:3132
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    PID:1168
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1100
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1108
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2252
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2432
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5428
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    PID:5776
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1120
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3000
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    PID:2648
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4668
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3476
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4200
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2816
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4796
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    PID:2644
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4592
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3608
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4180
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3576
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2100
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    PID:716
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:6036
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2784
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    PID:2316
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2852
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5484
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    PID:712
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4496
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5016
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    PID:5780
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5936
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2568
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1064
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2932
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1320
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:5308
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3352
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5144
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2500
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5392
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4636
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    PID:5920
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4888
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3484
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2208
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5820
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3184
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    PID:5828
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:6132
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4376
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:2264
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1832
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3436
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:1040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2496
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5596
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    - Modifies registry key
    PID:2620
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    PID:912
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{37B8F9C7-03FB-3253-8781-2517C99D7C00} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1052
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /f
    3⤵
    PID:1480
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5488
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:6060
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /f
    3⤵
    - Modifies registry key
    PID:1556
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3220
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    PID:5560
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:5212
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
    3⤵
    PID:4364
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    PID:4484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:2584

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3800
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 1EC6400A7A4000848B6C3241B13F4086
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2380
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding E7A5A1C7B56BD25392DD1141FA837090
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3184
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AAA7CFBC181EA5D54023D3F7FCE4E8DB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5400
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7DF4FDBB29030052F2F47D3F0BFB508
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3380
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding A0DA807DE9C85A1C08A91F6C0DCF6E97
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:868
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 8E0E50DAC46E67211E7A1758666F77F7
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4184
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8F0BF7FBA605037E2E8687903E4DF9D9
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4576
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7AA962281F9BA3DA069ABFD9CE20CD13
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C576AB6F68633CDE74B56FB79ED00679
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2648
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 58019136847BE81D20298C5E75911362
  2⤵
  PID:1144

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:612
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030647.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5672
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030647.log" -burn.unelevated BurnPipe.{52626AEB-AA8B-41FE-9DF2-9F775F67D97C} {7DEEBDAF-D9C1-4D78-860A-582FEF407600} 5672
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5316

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:4652
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030650.log"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2968
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030650.log" -burn.unelevated BurnPipe.{EA8A360E-0E3C-4B44-A053-BEB0C06F750A} {04A85E26-A696-4D63-B4D9-B4F3DF2D22BF} 2968
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2100

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2480
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030653.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4272
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030653.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1320

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:1184
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030656.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1332
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030656.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b0aad.rbs

Path C:\Config.Msi\e5b0aad.rbs
Size 21KB
SHA256 f8f25897f0b14d788ce449da2132501ffd1d3fc11ed576816c134c59bc888ac5
MD5 1f181f8e7de742edac59cdd569947d85
SHA1 7d7ef40c0e6c2599b62f5454abcbf6b0c7491e87
SHA512 2e1dc9a4459bf68a07d7a2c4cd44337170c919bc8f7de692d97c32ab67fad1bd09c7817241bfde49039305042ccd9b6eb604d91fd241da6a5ab9cb48e31a5c9d
SSDEEP 384:2iRLWRhwe5esSOMX3Mq8KywUNTYzxZKUpHgdmKpB:2yqCe5erOMX3Mq8KtyTYzxZKUpHgdmKT
TLSH
T181A2EC03B64092D3D8672B30DD2B1B657B76C7EA9311838B44EC92344F977C62F9A58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0abe.rbs

Path C:\Config.Msi\e5b0abe.rbs
Size 14KB
SHA256 98b5aae28e8343966f1f09e9d74b4253edac0e4799f5c7cb82b59d8be9ee464e
MD5 ffce1ad45666f45dab6c641b75412327
SHA1 cc96aad506d4bd97f7c321db8b459a20bb2571b8
SHA512 c0a465c1e436408fe2081270a5b7761ee2025151a40d51aafe471d1d01ced27fc1e344e48b5762c0844000e13f487aa302b70010e9c50bd910428cb237b482ff
SSDEEP 96:rMNp48xNpM0T7ztH8RgeDwYx12tH8RqeDwYCj71rR7c7QNpx1FNpLxcNpkFaxcTZ:rpRwYbR6YYaqbzfCgPo6/Wwfl
TLSH
T15752F003AB0586C3DDA62B30CA231B247B73C7EE9354835B21DDE1744E577862E8D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0ac3.rbs

Path C:\Config.Msi\e5b0ac3.rbs
Size 22KB
SHA256 538b1c77c2f67fc18a0857b5d0c99502cc336da5b0443f490b7b7f0eaabade2a
MD5 feba4474913a2aa1371a768412f52167
SHA1 5b3ad0f295b9dd04e0ee844175905764c092058a
SHA512 d6d5a46ed63df2eaeadf62dec827a01883c550ffa3e309632116e15d656ce5e39b930c139a54af073552226b8284ffb6ccfc19fb2250f69b1bce15ba93644217
SSDEEP 384:oxRgRR7NUZUGz5YkrcZqbogvXDB9yfoOFbq1OaK7:oXQmK
TLSH
T1B9A2CB026640C5E3C8AB2B30ED631B693B32D7D59394878B41DD90748EA73D72F5DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0ad6.rbs

Path C:\Config.Msi\e5b0ad6.rbs
Size 20KB
SHA256 c226cef770eb65fe16c7332b56da85ee786e433727121ad20fb79c454bd69186
MD5 ec1a8825b3322f20a7f516cfbe0fbb06
SHA1 d00c360dacc819ddaf759b46ebf50209c349b2e2
SHA512 976dc2e8d4b6c47dbcce0816e56890986a0127610503b43970a9db824ce94654f9af3219049a8eea1f6b580c5544db276e1a088ebf0a31785d8b378aedbcef4c
SSDEEP 384:5JRFglRGgFfXMawmn28I1S9HXVZFbLQPOkOOZ+w/IER0zWFPyqft:5fFgGifXMawmn28IA9HXVZFbkPOkOU+0
TLSH
T1FAA2FE03A644A5D3D8B62B70DD670BA57B32CBE59361434B41DC95384F933C23E99A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0ae7.rbs

Path C:\Config.Msi\e5b0ae7.rbs
Size 17KB
SHA256 a1bc1fbc55e8287b1b508feb9cdba7e30b8bdb12c7d9ff574432638b77bbd734
MD5 6900893dd63803485c24356f1b912dfc
SHA1 238f0b55e7e20c200b1090a9e152a66e58ccbaa4
SHA512 57dc629350f70f2d7e9c446cdc9d2be0cff309eb08c60385bc01de1d7973f639a0e61fff05c47089545868122e4b74e299c1ef1234919bcaeac3ca95a4e20416
SSDEEP 96:5eRp55Rp/NkWT8RheDd11xQo8R4eDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3TjH:5DR81GRn1Hn4Xyin5f7e+nh18X0Fy
TLSH
T12D82ED42AA4096C3E8662B70DD575B7037B7C7E5A344839B40DC92349F87BD22F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0aee.rbs

Path C:\Config.Msi\e5b0aee.rbs
Size 21KB
SHA256 d3e7208843a5765de9de80ec94d853ba63b47470aa7afa2bbd7ee74a0a9e8acf
MD5 c33190876a9611702de1fe064d8fccb5
SHA1 5bd921134fefa5a07c5437535d1d32668eb0775c
SHA512 ebaeb0249576f6db47d9c821c3847979d40cb9022e4594362dc14f55e06c5e5435ed73767f9107c6564bad092084c643feacbd3271619826bdf5122d358b17a2
SSDEEP 384:VLRIGRAnAKxNAUhUC7xJjrMNYPzIbSfhKS94wfIFsZ/kP:VlRwAKhkmY
TLSH
T159A21E03768089E3D86227B1DD671BA83B73D7D99351434B50ECD1388F633C72E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0aff.rbs

Path C:\Config.Msi\e5b0aff.rbs
Size 20KB
SHA256 88ae99e98679afcbef3899fccaaad8e96646f1bdac236c3906c8a0d5478e2470
MD5 00027765e0466fc8803a3b9c72fb68c9
SHA1 a81811c0f3eba148ea2f1ae8d5c574f78a1417d4
SHA512 86c6dc413e7cfbdfdcca12f7dde604dbe2638e778a60b3c1166aa8876c3d6886d3dea07e6c999a0da9b7dd3ad808193f36bbd52fb09670c03513278d4b458962
SSDEEP 192:ixRZ1kRx15dXcFUADIc1f+W+y4+oAkgCd+lc7:ixRZ6RxTeC81f/cqW+lc7
TLSH
T197920B42A684C9D3D8766B30CD231BA97B76CBD5A350438B50DC94308F93BCA2F9C69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b0d.rbs

Path C:\Config.Msi\e5b0b0d.rbs
Size 31KB
SHA256 79b46b4f2cb8480298cf1ce9a57a6214cd7527f30e129fdbb24a79554073c5bc
MD5 8b57b3d147d855249d3f0365654d51af
SHA1 9ab9370ebcda155abdc8e47473f41665b9edfb62
SHA512 02fd96b814b376736a8e838b4fe6a9a3646eccec250c92a34430f2eb423b2de89322f2bb8726670bfb876e3df8e9f60a538b10d9f4900246cfe9b84e488ccda0
SSDEEP 384:uW8N8ORYeR1Tu8iu8Iu8XcAlRTMV/ZawBV3yFgmk9Ru+Ru2S:uzLNsuVvRIVxDe69Ru+RuJ
TLSH
T1B7E26502F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b11.rbs

Path C:\Config.Msi\e5b0b11.rbs
Size 15KB
SHA256 0e58905938fd669ea16d654ddcd393d6fafca66b1fbfb54290be745892137dd6
MD5 06d8190a647a3e4f55b4fe7a11c83a8f
SHA1 502eece26bfc7acbb2a21af9f78bda162d97c1f1
SHA512 0a8c83f48c53a7ca1699c81bddbe3b802054556765618da0745aca8293ec61b946a8cdc390c683b4d71f0c28cc1f94896f14f31187fc3d339e66ab0f550fffa4
SSDEEP 384:wFWRShX27RRSmX2tR5JZpgBmQ7fpqPfdEZv:wI3N4W
TLSH
T1156230436A1681E2D8672B30CA4B1BA83F66C7D5D319834B05CD96308F477CA7EDC69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b19.rbs

Path C:\Config.Msi\e5b0b19.rbs
Size 49KB
SHA256 b7900d5c7ad90dd6eed4cf0ec69c3b10113db771ca952ec78d61bcfa36be54c4
MD5 e70c5e2fcc47b6cacd5d3549c3c8fda0
SHA1 12a32ee0f67d550dcf01b659de83b54f87487f97
SHA512 339ff3cc58b7917fe15adf40870c1c15090082f99930e95c478abee98842f457d4c4fd0cb9e5eac7d587c401c518364b9551ba91d603a889d1675286b955c455
SSDEEP 768:rSA0AQA7WVQKRy2Rs2iOD0MMGrLxBg3JfWKWzmEShDJpQZr/g8e+:bdQASJ7iue+
TLSH
T11033FE423344E6D3D6652A30CE030BB57F3BC2E69312866B54ADC5788FA37C66E85E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b3d.rbf

Path C:\Config.Msi\e5b0b3d.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5b0b44.rbs

Path C:\Config.Msi\e5b0b44.rbs
Size 31KB
SHA256 7cdd16eaabc9a9f93d2ea2aac91a5046b240ac5e92452f09d119f0d04857e187
MD5 9562a1109ecb6ec4bce9f9fdd578bdba
SHA1 00ab9149cb2bdce39d257df39cd8e4bdfc6a7a28
SHA512 6e8cd2a06aeee86f277d0ebe4d2122007650bfe3fd34a26f09e09981585a856e4503ea4155280c91099fd8dd89133d7a285bcb59a7c7628d71dc1dc7bf706b52
SSDEEP 768:diBn2hEYuxy1SQBygsAE6HRzY1WY3BYBYFY7YYYpYulxlQrnr:x1Om
TLSH
T1C7E27207F316A6D2E9493F74C5032B6CBF97D7A5830E064F44DDC8A00E66BC66A5538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b48.rbs

Path C:\Config.Msi\e5b0b48.rbs
Size 52KB
SHA256 d863b426aaaf12922a7e6d0fa9615101d36f95762c7827cd3b10c8ff7a3acff6
MD5 45921cf794f92614cdac39274a518730
SHA1 9f9e675022a4e2bf223b9a9b032b58e22cd70322
SHA512 4555ca9330c9e3a2166728ededb3481b47464da2bbeb897511942f230a5084f8e975f3d335543a7c138a2440ffcdb78b19e923ba412fc14509de2131fc36b5b0
SSDEEP 384:zlUvRWLRBt9I29m4Z9qjSZvPrwtFpCndsTfjUEulJGw8fR0KO1R0xJ9ZR0OBR0DI:z8qTx9qM7k6Ef327ru
TLSH
T1703351023680D0C2D56567B1F82B0B947B36DBD65722029F81DDD93C8E673C6AE8DE4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b7e.rbs

Path C:\Config.Msi\e5b0b7e.rbs
Size 41KB
SHA256 1bedf4800bc94bedf067751cfadf769a3288e102d6a0862f6a31c4355b2da1fd
MD5 72765524d087e81d6e48bfbd6fbedbbc
SHA1 9fb3ed41aa852681a672b089b63a860d1b9175ae
SHA512 f2a14bb3b1503e5e02559652bbd23db37835cc03273c53a70a56d9e618b607dd52fadb73ed9e77882967bdc9aa9ba03b0f554fd44042675de5d9a34182cfca87
SSDEEP 768:2QyMuCg21kTx9/DoflxL1JcEYcwN9RNugnLj45:ByMuCg21kTx9/DoflxL1JcEYBHg
TLSH
T1541352027900C0C3E5762BB1EC2F17847376D6D79B22479F85CEA5349E873CA5E89E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b84.rbs

Path C:\Config.Msi\e5b0b84.rbs
Size 3KB
SHA256 5d039250ecb2e26d27b58f054f3985ffc914c22619e61ffa34366a965b37f7fe
MD5 fc8f975f573e65a10e5c296ddc792be2
SHA1 073b34d5bee675e266a97f757cf6f4bd8bfafdb5
SHA512 2cd73d303d188fa90b2d0569e9a839e5797a4f89d04443a2355a0fe06ad4f72fcacf3be737189df94e03a4d11b194fa546de8a643213307acec291ee6be3680f
TLSH
T12B71B042DA4482D6ECA96B30CD471B2037B3D3DAC3648387158C91708E47BD6AFEA58A
MD5 SHA1 SHA512 TLSH

Submit Download

e5b0b87.rbs

Path C:\Config.Msi\e5b0b87.rbs
Size 3KB
SHA256 e754308a78760b45563c66c44b28a74ca17c01bd06174067a5d8c8225621863f
MD5 2762852e206a9d63a9d80abd5082fbe8
SHA1 7db5016eb59d84162c55022105bc829ab769e0ca
SHA512 fcff95056c921897410d277666be455f187ce618dfd1e8a7cbbbc99fdbae44dc89bc52fc5d200b9e280c69d7358bd08f6a602f4dab57d94857bec48da37b280e
TLSH
T11871AB03954893D6DCE6BB30CA571B1437B7D7DAD7648387048C92700E477DAAFEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e5b0b8b.rbs

Path C:\Config.Msi\e5b0b8b.rbs
Size 14KB
SHA256 e209f59af54ff23cc9f241f2ba8cdd0561a05c36612a7b27452db2cc1184fec4
MD5 fe4dbde9df04a211516307c29e83af55
SHA1 daa24a853e1fa527fb1feb7cdd9e73cee95267fa
SHA512 7a1b1d0b13b224fcc9278b784623c56c80fcfedae863fe112b24741e768f38abef9e30db891b2068e80574302c714b9f8caadba291774142ed24c7372dc9efa2
SSDEEP 192:ayJXuj2IYcw/0FBCq1TAkI4TAkJnFEXENNep6F:aytuj2IYcwOUoUOh
TLSH
T1CA62E042A60082D3E8AB6B74DE5727143BB5E3DBD391638B08CD91304F437CA5F9969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b90.rbs

Path C:\Config.Msi\e5b0b90.rbs
Size 21KB
SHA256 b19d5b1ab962a04a960a5eaf2da27317a9cbb16d0efccdb9dc60f1864acf48c0
MD5 3c5cf98c83dfc0854924102ff89d5bff
SHA1 7ac3e564390c9c1bc71913aa6808a1f5c63b9937
SHA512 24c90b190fad2981b86ba51683a73608795e05f5a5d2a8fcf80ecede424764cc06c9d3c996bbc0fce3743eb213db2a040dc9be7470563bdd954caa4ced60c90c
SSDEEP 384:JMT8MgXEtmrnb0MM0IE+AfCuS588UkRPQ4QB5XDcpq:JMT8MgXEtmrnb0MM0I9tAF
TLSH
T184A2DD42A640D6C3D8A76B30DE5B1B653735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b95.rbs

Path C:\Config.Msi\e5b0b95.rbs
Size 18KB
SHA256 c004634a593b09fce276a93b3eb4f2d1d7d749c43835e4b90973e3f18e0250cc
MD5 ed5f2fecbfaa60a17433e266bcdf2ffc
SHA1 a68a73ed5365219b3b31d21086f71a506ae19a98
SHA512 881b2fc36ac4a126a0431859d2ba6062b348d11f7534bd968674cdcddb766b80f685501e7cc790d01679ed014e943370a8223b29745a7c49d1f6317d632bad00
SSDEEP 192:J9DAoBHRq+M3NinQv7XZDtY1eCA26fUIV6fUg03ETLNfHOp+:JxAoBHRqF3NinQv7J+/6fV6f7X
TLSH
T1D192EB416A40C2A3E9A63B70DD5B1B1937B6D3DAD7A1434B41CC80748E837CA6FDE58B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0b9a.rbs

Path C:\Config.Msi\e5b0b9a.rbs
Size 21KB
SHA256 43deb8329a23c7ebcedea57cd6237ab6969d2e7bafa3024a37cd9b7f34477cc0
MD5 7dea17354ed4d0a7abcdd776d4bba907
SHA1 3be48751939ed72d17ecb92e1b074a100a524a51
SHA512 04851ee20da319f0f96f385161f9c36e2a00da97b6a0e089a8c784e3b00e3b3402cfc5ffb87b8b16554912d3e3fe743e8ebd69beb49ebc48957d6ee48a268372
SSDEEP 384:IT6tFYQxkA+pAv9jH4ryInsalckU72eC6PZjrzMz+2Y2sLH:IT6tFYQxkA+pAv9jayIiZXYa2YXLH
TLSH
T132A2EB017A00D296E4AB2730CD971B287776C3D99361D78B80CDE1348F937D66EED68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0ba9.rbs

Path C:\Config.Msi\e5b0ba9.rbs
Size 41KB
SHA256 8e647cef67deee69ace743730ed1ded506cb76634d49a744092d08e631438f33
MD5 517fa5a57c93cbc54df30af04c162473
SHA1 b4a0abd67ccfd13d317f278cd1be998dbe77700b
SHA512 0345cfaab50a31d7c804f328023d7f9bda2f1057345fde9ea088f8466969323d44810dc8879ba8980fdf34646ce50e1b586aefb498e9f42329d1a95d2a8c802c
SSDEEP 384:+raSWXI8pxL6+YgpiqeHs0wgdKNklYgHQPWdQwJrDQ8SQo5JQmjmNJoa73eiU5i0:+BW4uxO+YgpiqeHs0wgdKNk5Tjla4Oqg
TLSH
T10B13F0426600D2C3EAA61A30CE071B757B7AC2E6D715976F14CED0704FC3BC92E99B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b0baf.rbs

Path C:\Config.Msi\e5b0baf.rbs
Size 3KB
SHA256 72586aead893b4674ec5e4d963c12515831594dd087b6181c45443c9779cd75d
MD5 8bfb37d83fc89f213a401db0d43cfcd6
SHA1 2238fcfb7e55ab88dd6f28198f2662344515d8e1
SHA512 e4c55b4d4243474aca8b03b26ca166b397acd56170440abe3bdd1c6eec611ff6dbe748b8fa323816090257c4a3bce3cde9b8eb651768ceafd777b44e8a8daf45
TLSH
T19671A9039904D2C2EDE63BB0D9571B2537B3C7EA8790938B11CC91704E47BC6AEDA24A
MD5 SHA1 SHA512 TLSH

Submit Download

e5b0bb2.rbs

Path C:\Config.Msi\e5b0bb2.rbs
Size 3KB
SHA256 323387afe328ae994d420e2e8ec682858dd32b52b02149acb3cc30816b6a6824
MD5 456c145bb5080669debe0bb9227fbd88
SHA1 9636afffdc84f4df2b06cbc755633034de785da7
SHA512 2ea3e20d3e96c6fc64a93940c7691d839191494da5af6123cf8b6fadc09e658f90dcdfccd5d6aeba9fa008019e9a933d3659b3297bb1c81b998640ff4da72cf1
TLSH
T14671C043994496D2DCA62B70CA270B6837B7D7DE9750438B458CC1740E877C5AEDB28B
MD5 SHA1 SHA512 TLSH

Submit Download

e5b0bb6.rbs

Path C:\Config.Msi\e5b0bb6.rbs
Size 15KB
SHA256 7c7a40a3e2487e3cfef7e61d4e28114386b73990cf096fe717798a6257ff4d55
MD5 3907a91ba7390c1b878165bff3ec7052
SHA1 59e2000e56d781e924d307ea5310bd1e8e93e951
SHA512 cefbe8c5fac3b9a524bf86eaf7b0daa1fc832d0453101ceae83093a24151ba782fdc1244c35b838681d8fe59db9e4f409df2244af83845182641441f27b328a0
SSDEEP 96:jrXNpU0jNpgbKwNNNNXsLV9NpvHP+HRxWR5OeeNpVZCPzerzeQKwSU2MeD2gARCn:jrSKLlR5UCO1sAkIgsAkyH/EnwNWepFh
TLSH
T14B620E02A600D9D3ECA22B34CA972B583772D3E6D354934B05ECD5749E87BC61F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm
Size 584B
SHA256 40f546ddca594aab22b8a1153d71c478fcc65d0668c834afbfc3d13d7edc4f18
MD5 038d50ac0375cd9f81fca57810b0184d
SHA1 7b4a3051f6d321c7ac6652751b45d3d870c381d2
SHA512 47c4d375437099c75f0b70665a30af949c4900db1e3b6ae9d863346fc1f11946eabcd294fa69b191e9cf9440174b59c28fea45373d372045afa73be2a7e74cc3
TLSH
T1BAF0EC654FF2501DE2B3AA7178F50A56596BB8036931C52E0182328BDF317C0ED68B56
MD5 SHA1 SHA512 TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
Size 232KB
SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
MD5 824f1f188704d3de77660d90fea6b136
SHA1 9bcad1428defece9f2ceaf647d9571ca41b3f40e
SHA512 0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972
SSDEEP 3072:55Sa1UNmUq59Zh3pe8lwAx9JHHpXhvq5J38J:55Sa2qr/HHpxva
TLSH
T1E7344C11B552C133D8853332406FDFA12AAC6EE79B52C58721E932DC6EB17D4D3792CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 28KB
SHA256 2524a822d83eb2c6fd94cb986586a8f96486f3ce18041ac559475deefef406b6
MD5 952d1684d29f0c3351adaea8eb0192ff
SHA1 ada48c2992be5e70ce3ef81bc1f9b5fc95708a4f
SHA512 1f3a07703d29da1cc9cf2933659d881f064008fa556d92d90b40169fd68a954ea15e0352ac5e6e6cc7e2cb7908e183ddb15ce0719b0a27d67361e05a34afe6bf
SSDEEP 768:ZaSz7KzGs+PFJE7ynC0u5Qn3RAL9iLbO0inwJz3/o9L/Y7xoXyEMdBE2SEAgEEc4:yL9iO0inwJz3/o9L/Y7xoXyEMdBE2SEv
TLSH
T1ADD292187D8C523579F0C3B6E33592C2FB6ED5A25B30E68C7CA6C8A0746B116907E3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
Size 971KB
SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
MD5 1eb17f650462eea820f4cd727d2d3ab1
SHA1 688f59160589ffa293502bffcd5c0e62e1993903
SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
TLSH
T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
Size 900KB
SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
MD5 3df1d7da8c1493a5a00c0474323fef20
SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
TLSH
T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
Size 101KB
SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
MD5 ce18bc86e63f3192719ce0d7f286a130
SHA1 86a935fbd2fd9f5b39307ef986146cb2ff2adc33
SHA512 236bf295e0551ba64d743833ffc5c1d1b5b4915c9df5ccf3300013c765befb37808651087c388962e2f7bda0a143a406f923f408a24373cee9e6cda49aae5b73
SSDEEP 1536:7Jr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016kyBekazo:7Ji6vPUL7zxwXmh8Gf99XZ7Bwk
TLSH
T125A3F81483FC4F61E6F71B742DF6A0814A72FA625EA2DB1F102D410D1C63B949A62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Size 27KB
SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
MD5 d0958d7bb727740c9d9952b1805163fd
SHA1 a3b18971219311fd6a7e5f2be14979c3777d4d68
SHA512 138bd86e0b1f0b32ba453475e1fa81e11e9d4300db197b58301a5d478b3213079dc30c700f52220ff957fef10c4c85d1230308d83cf7560547b475fb346e1460
SSDEEP 384:Sp0wdaXOa1FnKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81dWIY83gWQsLBiHR1:O0Ka+q+6rqnDPOyBeRmoQ9zpI
TLSH
T139D25628D3F85312E2B38BB099F5C447AD76B953AE34C7AC2596534D0C227849963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Size 31KB
SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
MD5 55c9882d7612e7e8b69fa5920410be3d
SHA1 9517d22cc6d9c7f9b64d2c8152849a9075027c91
SHA512 a6fc94a8a0d6a690493819efd463b5263871346a94e7a1caa379871dd1fdc6527311b02eec70c5b49406aec53bf4e2d04d14c592754bdd3f6a251e64f9e2b024
SSDEEP 384:F52RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYWcsLBiM:3urKjgEnGEFiJrvPAOyBeF29zKk
TLSH
T1A8E2962893F81312F2F35B70ADF5C483A937BA03AE35D76D2586174D08667849963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Size 137KB
SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
MD5 b5c91699e57a807b2143cced62e70e77
SHA1 067f80a3c6b16ff9c4acff06099393084b6368ff
SHA512 d843235998b04d8f857239b31b5866c5328de3455b330f57be5f61acccdaadfa174231cbc57eb07f8cc5f7f3d8ba598fa0399fd8d13759d3c428d31a07265003
SSDEEP 3072:nEmV8EKUaX1IrJeE+6pwluGCulHxTqo+UeYBs+:nEm5azUaxWIN
TLSH
T120D33B11B7FC371AF2FB0B79A9F96001C97ABC556A26D78D1851424E04B6FC08A32B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Size 79KB
SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
MD5 2c100809815e27163493ea5e81010d1c
SHA1 01ee717e6f9d6c3d574ffe82c1cff3cf2467419a
SHA512 c22de3606e5cd1a9ac2e1cbca3c156831d5cbb99a50e4ae9f34df7d93b4d9093447d62b3fdc031be84a6c7adf16e23f7b5b44ba4eddf21bca13a26704d8a6b63
SSDEEP 1536:QdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHp2gXmyBejjzQka:yYR63P8dlNGu1IcT7TXLqngXNBCjkka
TLSH
T1F983391193B88327C6FE43B464F0A8125FB9F253BEA6E71D09C5A39A48537C18D5272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Size 85KB
SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
MD5 33247411fefa060b5f86eecd66b95078
SHA1 74784f9e3da6f1579a22f5723d46c5de50add359
SHA512 c1ad16c956cde61fee693b1483905ab6711841750bab35848a1e7261165f37273d8380daf8e6f4d2d35d520ec52fa943938f3ae7ea056a112bc9200d7e49c136
SSDEEP 1536:kkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79sShdX+yBeS2TzR:kk3gCbzexZG0YUBXfqidDhdX1B+Tl
TLSH
T18D835B27A3E85713D7F74630A8F09A03AA71FAC37565D39F2046672908AB3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Size 44KB
SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
MD5 c2e0ecbe64eb072ed008257142315526
SHA1 3d732f858fe67bae8f369ef19ef282e11a83f656
SHA512 5e0d2a7484e63254e455d6e9da44f79533638607e41d7c4eaf77529f6dee50904a675d8695a8e5c0ac835e813f2a7e11e7b1e0cfdb82553edf653451fe816203
SSDEEP 768:Tc1JB9Xaefxf2ZquXoQGaVP6rqnig3MbvyBeHO7Ex9zQB:A1JHXtp+ZquHVVigczyBeHljzQB
TLSH
T17013D72493F80313E6F757B099F1E443AA777953AE29DB9D1099574D0812BC1CA22F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260806030650.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030650.log
Size 7KB
SHA256 a2587d294bbc04faf535368a834b17f736c675525aefa7d8f33004f9b35d2982
MD5 b3aa69366614352c202a84b73ccfa9a9
SHA1 171fcc2b30588f483da7e4180b92fe90bff01fe8
SHA512 816ba51ca553ceb654f5080218d5760f06f479b6ae75c2d2c4804fec9e1c6bc5e132470f97aacb255e5fdfbc661206125edf0b763618edfc6b110174d907ad49
SSDEEP 192:BcV+V7VRVIVZ2uaCrZVCVoVq4GVHVlVpE:2V+V7VRVIVzfVCVoVqhVHVlVq
TLSH
T1D9F10F029EFEA3A03CA5E6AFE0665EC95E1A333465406530BB65428D82474F7FB5BF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260806030650_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030650_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 5fbe0acf23af6921b527fec8af27a3ca62a12d15d014a398e69ce5ee74c8d8ce
MD5 3a43ccc889a24e0c117bc8789e58c737
SHA1 b4f6fc3311ac4f2bc4db0b8028a5dc0eb594d1d4
SHA512 53e5402d6a4fc571b864dde7ab543c84349aa7cde4640dfa2c2c40eec2bf269aaad3e3e0e92c6c678af2edebb2ac64750171080448ca97ba6980d4e6fccc476f
TLSH
T13C4116602BE80805B0B61657DEF3C063AF33FCEA79398B0CA245831A066BD015C6C77E
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260806030650_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030650_001_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 e1b725a128882bbc1dfee85c30f4f82c6897d0aff7d1d5d52f0af4ce1ba751a8
MD5 bad321b18f07158d971f9844afd5fcee
SHA1 499c2345056e13dc7bf2d79e0fad9e20672fba11
SHA512 3b656176858581669ecad562cb3089b0dc27b920674c579c87fbbe20e13732e274d26c4c32dede016e01f147af59efe6d36f32bb66671fc6cd9d8647a26e3609
TLSH
T1124116691FD90C05F0B66B47AEF3C052AE33FCD278398F0C62899319066BC01695C7BA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260806030656.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030656.log
Size 15KB
SHA256 997edf545edc158d511b3d61d48dc01bef2cfe40776d6742f9276f9294ac5c9c
MD5 275566cf9caf8d2fee6b1f33df7f9d77
SHA1 1e67cf3a5e06517788e2157f5428120cbc2e1105
SHA512 2d4a89273acd8e7aeaa3fe58e1c5ce062e22ce8e762df1aecca3925d9e1a51ff37e4539736199c2f8f4ac53a42dae5c2a74ff8de646817854a7830ef6fdf7e62
SSDEEP 192:xQJnV1p1X181w1f1d1a1atzih7U1UZH9WB/thN3z++3X:xattziv1ithNj+4X
TLSH
T15962E10215FBA7543CA1DBB9E0FF4FD65A8B71B426041070B7591289E3C78B7978ED82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260806030656_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030656_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 8b1cb5fb072ac6320265812dcda38fe1b6f48b10d8702c9e499b17320d0ffc41
MD5 1fcfa8dc5a7590b7ece3f0c02a24bae4
SHA1 1482c74b77051278640f42684030acc381cf41f3
SHA512 f25181d7176655f2e375131568af2c9d5180f370f71785ce44f78b16113988403a25d92b90567813fe53d6727e5383eccde7aac2529cbdc6f2fb5aef6beef669
TLSH
T1F241F4A51BD50844B1B72B07EAF3C0537A73BCCAB835CF0C6B458319067BD06596C7AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260806030656_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260806030656_001_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 18901a0f6f613b61a944a63f9d0aae7e3e41696e28647c04bc5a89a728538b11
MD5 860b8129f84ca139bb5e2f3d86782d6b
SHA1 e781f7f8a27e6847eee5f668f4f359b83b0532bd
SHA512 1a8e3c9eb56b0a64ebcfa11da6c2b3b3e17b9bab0516b8f68b658d44dd49547bc0fc6380f9fc57eb023bcca5cf9b66b3e50f3b0fb5a06071c8043e8c5be57b78
TLSH
T11141E5651BD40849B1B66A07EEF3C1536A33FCCE7875CF0D23468319067BD0658AC7AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260806030647.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030647.log
Size 7KB
SHA256 484ef42a9cf61aaec8c5a4d5de6d65999817ee78bffabfd6402c187fc48e3000
MD5 c79774902d75947c1a997f7beb904576
SHA1 942e1839e41c61cb44d3c340615e522b5430c692
SHA512 349eda870f33cc974990f5326dd43be6dd933e5f647a461ae48cfa94747ce09ac443dc7edd78856c52e76bdc1967f6835f8bb0cf203d8e0d6112c3302f249cb2
SSDEEP 96:7CIbw8bkcbD9b8Vb71Ke3b4O4NiTDAb4bKbxD0zwebxb/tCSbey:Tjj98ZK74q2wWd3ey
TLSH
T140E1F68115EAB3843D92F2FFD4A92FF9591AF1342A841170E5D582ABC507C36FB8DD42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260806030647_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030647_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 8150bf4b9dd3851dac1697850fa3883647844de6aaae82a8306af4e6c29bea31
MD5 3aa7bfe97c9a8da414882f0caa6fe743
SHA1 d6c4c9b5940b009033c4f394e0334de98011506a
SHA512 3c6a7bce734b3cf01a50b677b87c6e1fb22eb8683154453418aa36a529ce226d9596afb67e4e3917c6fd0c74259ebfc24a39f4e041dd95092571a94b933c5ff6
TLSH
T11741F6651BE4080AB1B39A47AEF3C0635E73FCC27974CF1C6244831A067FD0499A97AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260806030647_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030647_001_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 e73982e8635d50f48dac6e8827582f28bd1e85378904e807ebd6b7eb8a6da1b1
MD5 0973215c196a05475556c0464a394b52
SHA1 11687d2451f2fd28fc8e4f5b199b4e51181d242e
SHA512 4f618708e7b5c64eaa8126b60606177fb5c611598516c48377c1f6a806cd7900a35aa090df830663c2f015406b170b5c63aeadd2eb6191a0f1f74c82f373aa77
TLSH
T19E41F2941FD5080AB1B35A47AEF3C1636E73BCD27875CF1D2384831A067FD0599687AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260806030653.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030653.log
Size 13KB
SHA256 25121dbe5b63c68ed2f381629c3657157a5b9a7f90fa83e4bc848b091456512a
MD5 d4a1bcce4416740dcf77d074e791ef0f
SHA1 5c3d3e2c3b3ac67b053f9f395d53ad6a7e76a717
SHA512 a53050e09da1cb218ce5efbf037f8bb68d0c63f2ae069041c306e8ef067c0201369f7bbfbf1049654c7e23fdfa34e2878486e283a9cff2166f5c4930777b13e1
SSDEEP 192:VHHxnZ1l1L1o1U1b1h1G1zEWjQ02swAN1aq0UjS:VH5UEWjZN1apUjS
TLSH
T12F52330221FBB2127E91E7EAD45B0FE699AF7234BA402478EBD4058E9316877D74DCC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260806030653_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030653_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 65a870cab704d0c1fb3e870f7ba2ddf7b73f8b80f21975f59ead2a0c3d85ed57
MD5 3b7890ee8b386d8aacd36c077d86edb0
SHA1 6f8fe99d52ec25b1331b2e710b2add4e9d76d9f8
SHA512 09902f4dd06a4f157ae87482f55d663ed2bdee331ae37cabfedb8b27a151422c6960ee4b7bbd8cd55c8b108fc9261d66f7b8231650faf3720b1683b2b67950be
TLSH
T1444126641BE40806B1B36687ADF3C0136E77FDE67835CF0C23849319066BD056D5C76A
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260806030653_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260806030653_001_vcRuntimeMinimum_x86.log
Size 3KB
SHA256 64fbece2031ffa929322ab33ad71b299b4b6bf38bf444b050bd5b1a29db5b668
MD5 46e1ccddd8c4c69a409a4d5b6c967c6c
SHA1 85fdf2eb8ec17e141203192ef9e193810a4194c8
SHA512 ea280e3c7cc827986ac22f796ddce951e7708a846cc7e1c14c4ce34614b8e5cdebd6c7448f6e42cf34d4206ad1a86406cffa086fff16b6b16933b82910cddab7
TLSH
T1D15101601EE80C25B2B21A47EEF3C0131A73FDD268758F4D6349D31A46AFC066C6C76A
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 984B
SHA256 62248ef42618154e8527372789879f3448709017b63993ee75d1776c7a9c8216
MD5 5a83a0d789ed6f02421d44bdccd87cd3
SHA1 152fbeffaeac96dea12cdffc8b55e76502f4358a
SHA512 c5cb0eebecfdfe4bde5144155e3f4fde77b468e674d3f3eb22a9c1a1e8a4dc208701e4a88515dfcff0d794e68e7f0ae083bc49ed2fdf652d390d1d16cca28886
TLSH
T17211D69255244152B9B321000B2749612FB59F2A31D7CA1A45C9D9A3772BFCFC4AD38F
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 444B
SHA256 f5533eaab75ce285af93111f1602b45c7874c6c4eff3161aefca592e8d1d42ec
MD5 058ee11acbce78348c14401f6d90b0be
SHA1 b8f5977a266eda796b9efbb2bd82cfc241df801d
SHA512 6ada4b2ab808d75a64156a81f1a413f907052bb6ef8025fa781723cae72404dce88a1bf33dde0f645fa0ad4a571fdf6f365b769080cbadb72dfa00c8503bf845
TLSH
T171F0A74245304015FBB161010B5F49083FB8976B21D78B0556CDE580323B9CBC49E59F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
MD5 826ab855bf3d4cfbe442e5c29341c742
SHA1 0f76eaef902a256221ca8d309b46e480113669b9
SHA512 d053526e1ec45b6667699689e80ff30237a860dfa35bfdbef2885d8c525e47b3886fa17e3ae2b35e69601305ef450ccea60dc85e6023cf0ea3e20777a26ddb02
TLSH
T1D0F0E28696214016FAF322100B1B49553BB5DA2731E6CB0940C8D9A37627ACF84AD29F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
MD5 89d42ed52b434f87f3408bf635d31183
SHA1 152a56d81427313371addead21536d631fc8c7fb
SHA512 392c0c0b574b88b790a35dc4c295723f14e5a02b0fb8e8705ae767131312fc9aee7fa41411f808a35c6408b8932b8d920020092f9ac518542da0fa5d30d356c0
TLSH
T13A01F58656214017FAB322100A2B49642FB99B2731D7CB0A11CCE9937617ACFC4AC29F
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI379E.tmp

Path C:\Windows\Installer\MSI379E.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI42B9.tmp

Path C:\Windows\Installer\MSI42B9.tmp
Size 80KB
SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
MD5 393da89078925f78e19445882c37fc59
SHA1 1313f4e6c62670f1b10aaec77c105be275f50121
SHA512 aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
SSDEEP 1536:d+/OTT4YIb6rkCGoNGXbGKauVj4eKtHa/cJg95k:4OTMYRradauqCcJg95k
TLSH
T1AC832A2179E1C231E8E2777406FCA6622D7D78B14778D4CB778842ED8AA17C09B39367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5B16.tmp

Path C:\Windows\Installer\MSI5B16.tmp
Size 97KB
SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1 a520426523be085ec67291241f4219ab13f4d4b8
SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
TLSH
T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI62B5.tmp

Path C:\Windows\Installer\MSI62B5.tmp
Size 93KB
SHA256 fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
MD5 186694813c3d5e33202a1a72c5079cc3
SHA1 90a9c2bf6419be6f46999e137c2149feca62cd13
SHA512 57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b
SSDEEP 1536:NOTekneIYoT5jmIN0gaD4Prbde67Z9AlIZzxIgU9rHUD:NOTekSoT5jr0BDKEawIZzx3U9oD
TLSH
T16F934B4523E840B6E5B7927CC9F69A06E772B4411739A3CF1174829E1F63BC49E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6AFF.tmp

Path C:\Windows\Installer\MSI6AFF.tmp
Size 74KB
SHA256 be2ead50c4cd94d33c7f1e7c00b47744cb4b4309dcb349236cdcd447265ecf4b
MD5 d557e10dd63535aae79b780fbf83961d
SHA1 67fdf4459fab259f61da7ddd342261243b916a94
SHA512 ab7d5ec81a3e4367b51deac213da79f9b3a6f5be505f4900121b19bffee4366dabf9674753f6ea82e35a88080b85b1e0f2eca790630f879f850aa322e4068feb
SSDEEP 1536:C/sWkKt5Qr09UcBO8IDNg3D+VYBli7woHKy5bJuR3nW+d:SJ5Qr09nGe3D+VYawa5bJc3nW
TLSH
T10B739D213651C375C19728B5E57AC2716A3E74201FE488CE7BA60B7E5E322C17A7B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{1308CA7D-1C1B-434B-955E-88C749E539F3}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{1308CA7D-1C1B-434B-955E-88C749E539F3}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{8F42A505-4D20-4111-9CF7-79EC97BCCD31}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_000_vcRuntimeMinimum_x64.log

Path C:\Windows\dd_vcredist_amd64_000_vcRuntimeMinimum_x64.log
Size 3KB
SHA256 98c99da3ee8ba8d3ee7ef133821a0c9214a7094f901fa7a156e4e45a31d720f6
MD5 9b27c7c54ec86773a03d647c7da3ecc1
SHA1 9ff42e1fd1b840ecc5bc55d53034207037022902
SHA512 e1a83062dfdf247453b936494441cb8df803a698f594ea20cc9cbccf0cd66ee22041d4533c65f4be7fb3da855c090af4523c38ec3909f1b427236b4d6f926dc6
TLSH
T19F51A3241BDA0C0AB1B35B17DEF3C1635A73BDD668748F0C2348D31A87AFD065898766
MD5 SHA1 SHA512 TLSH

Submit Download

memory/476-2110-0x0000000000AF0000-0x0000000000B67000-memory.dmp

Download

memory/1320-2064-0x00000000006F0000-0x0000000000767000-memory.dmp

Download

memory/1332-2111-0x0000000000AF0000-0x0000000000B67000-memory.dmp

Download

memory/2096-1937-0x0000000000AF0000-0x0000000000B67000-memory.dmp

Download

memory/2100-2031-0x0000000000F10000-0x0000000000F75000-memory.dmp

Download

memory/2640-1939-0x0000000000AF0000-0x0000000000B67000-memory.dmp

Download

memory/2968-2030-0x0000000000F10000-0x0000000000F75000-memory.dmp

Download

memory/2996-1679-0x0000000000990000-0x00000000009F5000-memory.dmp

Download

memory/4124-1821-0x00000000006F0000-0x0000000000767000-memory.dmp

Download

memory/4272-2065-0x00000000006F0000-0x0000000000767000-memory.dmp

Download

memory/4868-1940-0x0000000000AF0000-0x0000000000B67000-memory.dmp

Download

memory/5316-1893-0x0000000000990000-0x00000000009F5000-memory.dmp

Download

memory/5508-1678-0x0000000000990000-0x00000000009F5000-memory.dmp

Download

memory/5672-1892-0x0000000000990000-0x00000000009F5000-memory.dmp

Download

memory/5872-1824-0x00000000006F0000-0x0000000000767000-memory.dmp

Download

memory/5888-1823-0x00000000006F0000-0x0000000000767000-memory.dmp

Download