Overview

overview

10

Static

static

5

Gereksinim...ll.bat

windows10-2004-x64

7

Gereksinim...ll.bat

windows11-ltsc_2024-x64

7

Gereksinim...64.exe

windows10-2004-x64

7

Gereksinim...64.exe

windows11-ltsc_2024-x64

7

Gereksinim...86.exe

windows10-2004-x64

7

Gereksinim...86.exe

windows11-ltsc_2024-x64

7

Gereksinim...64.exe

windows10-2004-x64

3

Gereksinim...64.exe

windows11-ltsc_2024-x64

3

Gereksinim...86.exe

windows10-2004-x64

3

Gereksinim...86.exe

windows11-ltsc_2024-x64

3

Gereksinim...64.exe

windows10-2004-x64

3

Gereksinim...64.exe

windows11-ltsc_2024-x64

3

Gereksinim...86.exe

windows10-2004-x64

3

Gereksinim...86.exe

windows11-ltsc_2024-x64

3

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...er.bat

windows10-2004-x64

3

Gereksinim...er.bat

windows11-ltsc_2024-x64

3

Gereksinim...gs.vbs

windows10-2004-x64

5

Gereksinim...gs.vbs

windows11-ltsc_2024-x64

5

Gereksinim...ol.exe

windows10-2004-x64

5

Gereksinim...ol.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/08/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Gereksinimler ROVİDA/AIO/install_all.bat
  • Size 1KB
  • Sample260823-e88mysxwe1
  • SHA256 492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
  • MD5 SHA1 SHA512 TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 34 IoCs
  • Adds Run key to start application 2 TTPs 30 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 30 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\install_all.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x86.exe
      vcredist2005_x86.exe /q
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1104
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x64.exe
      vcredist2005_x64.exe /q
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:1188
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2008_x86.exe
      vcredist2008_x86.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4060
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2008_x64.exe
      vcredist2008_x64.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1844
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2010_x86.exe
      vcredist2010_x86.exe /passive /norestart
      2⤵
        PID:2808
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2010_x64.exe
        vcredist2010_x64.exe /passive /norestart
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1528
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x86.exe
        vcredist2012_x86.exe /passive /norestart
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x86.exe
          "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{E9354C45-70A8-406E-A9D5-6FC53DB74582} {B89930D8-E3D7-4E51-A9EC-D1B637915DA7} 2244
          3⤵
            PID:3540
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x64.exe
          vcredist2012_x64.exe /passive /norestart
          2⤵
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2372
          • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x64.exe
            "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{D06D21DB-A937-4295-A721-742D739C0D3C} {4D04FF45-C6E5-4CC9-B818-B29A4B6468B9} 2372
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:4744
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x86.exe
          vcredist2013_x86.exe /passive /norestart
          2⤵
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x86.exe
            "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{ECE57229-F3B5-4C92-B22A-CC5563AF4695} {0E6B637B-4FC1-4EF1-B718-F3D4103AC61E} 1780
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:4056
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 908
              4⤵
              • Program crash
              PID:1236
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x64.exe
          vcredist2013_x64.exe /passive /norestart
          2⤵
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3272
          • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x64.exe
            "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{30B4DDAD-E370-4ABB-A532-BE30B11F4C15} {3F8E7197-BE2A-43B8-B305-BD5F11538689} 3272
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:220
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x86.exe
          vcredist2015_2017_2019_2022_x86.exe /passive /norestart
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1768
          • C:\Windows\Temp\{C6A2F077-EFD2-4164-A02A-3FB23F5B953F}\.cr\vcredist2015_2017_2019_2022_x86.exe
            "C:\Windows\Temp\{C6A2F077-EFD2-4164-A02A-3FB23F5B953F}\.cr\vcredist2015_2017_2019_2022_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=704 /passive /norestart
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4332
            • C:\Windows\Temp\{FFB0D39D-65C6-44FA-8F4C-B356F85408A0}\.be\VC_redist.x86.exe
              "C:\Windows\Temp\{FFB0D39D-65C6-44FA-8F4C-B356F85408A0}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{1CF5A928-04CC-4E34-A4A6-04922655F4EF} {06E55EA3-5DDE-4C5C-9783-536D65FFA976} 4332
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:5028
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 1152
              4⤵
              • Program crash
              PID:5564
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x64.exe
          vcredist2015_2017_2019_2022_x64.exe /passive /norestart
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5736
          • C:\Windows\Temp\{56DBAF3C-10DF-401D-A37F-DE77303ACF90}\.cr\vcredist2015_2017_2019_2022_x64.exe
            "C:\Windows\Temp\{56DBAF3C-10DF-401D-A37F-DE77303ACF90}\.cr\vcredist2015_2017_2019_2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x64.exe" -burn.filehandle.attached=672 -burn.filehandle.self=700 /passive /norestart
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5796
            • C:\Windows\Temp\{E2021DA6-7CE5-4FE3-9412-FE399D5B2420}\.be\VC_redist.x64.exe
              "C:\Windows\Temp\{E2021DA6-7CE5-4FE3-9412-FE399D5B2420}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B91C2538-9C94-4A8C-8889-43B18C5F2F82} {14948C2C-52ED-4D98-BC7F-0B1543659A69} 5796
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:6104
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 1176
              4⤵
              • Program crash
              PID:5564
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:460
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          2⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3724
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding AD97FE882534202595240C30723C5454
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2388
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding A37F038A850CE9F84A7983E8E2B90BF3
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4700
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:2992
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored /burn.runonce
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4928
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored -burn.unelevated BurnPipe.{87906679-F9AD-4F85-A1CF-FAEA3D7BFD5E} {7BAAA59A-5817-4246-A4DE-393977167DCD} 1480
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:1968
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log" /passive /norestart ignored /burn.runonce
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1844
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored
          2⤵
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2020
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored -burn.unelevated BurnPipe.{55D419AB-630A-4CE5-9831-F4E76E220B04} {EA02E38F-EC52-467A-9024-9A0D9856A94E} 2020
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:564
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored /burn.runonce
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2220
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{52B51F3D-F09D-4215-BC54-8927C06C2D83} {935E9BB0-3909-4AB9-9247-FEDAE84F8341} 4360
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:1772
      • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054751.log"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4304
          • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054751.log" -burn.unelevated BurnPipe.{4D6D4194-7699-45A4-A999-09AA3B0494D6} {321F7AED-EF5F-4BA8-BB0B-9B693F5AF533} 4304
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:1040
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 1152
              4⤵
              • Program crash
              PID:3920
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log" /passive /norestart ignored ignored /burn.runonce
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3712
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{83C380B4-7674-4B3F-A049-546F30C8665A} {19737706-99C8-436D-8CA2-26BA684803CD} 3712
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            PID:4976
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored /burn.runonce
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4308
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored
          2⤵
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{653B6091-5C87-4EE1-B66A-3E2C7502729F} {F48FC246-B451-4FDC-939A-E43AE45722BD} 4540
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:4060
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1016
              4⤵
              • Program crash
              PID:1784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4060 -ip 4060
        1⤵
          PID:4388
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log" /passive /norestart ignored ignored ignored /burn.runonce
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:1256
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored
            2⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5072
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{4801CC23-C9A1-4BC1-914F-D031B7757575} {AB2D2EEB-984C-40C6-AEE6-B96DF3379ED1} 5072
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:1380
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
          1⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored
            2⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1968
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{C55D47AC-44BA-46F9-946B-2E82EADB3FD3} {7D92C17C-7757-4825-91D1-7F360EE531D4} 1968
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:4524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4056 -ip 4056
          1⤵
            PID:5080
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2264
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2504
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{82DA4165-C6F8-4281-9011-B8580EE82A1D} {3BCB460A-49AC-4454-BCAA-B064219C2B12} 2504
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:4808
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5004
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:2180
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{16AB0E98-D253-4FF5-AE72-3F59C0EE2249} {8AB4A227-B66D-4E23-84E8-6C4C1397EAF8} 2180
                3⤵
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:4184
          • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:876
            • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054757.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3404
              • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054757.log" -burn.unelevated BurnPipe.{F415F118-B690-4485-A9F8-69B208112370} {6C5C5167-12BD-4043-B133-CE6B2E401908} 3404
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1684
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3940
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{592AA5C1-1805-42FD-94C6-7B3842164F26} {825B38DE-FC46-4437-89EC-E311286784C6} 3940
                3⤵
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:4260
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3276
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{C2D4A1BF-08C5-4C1F-BC5E-F15DCACECEB0} {2B644AB9-5B0E-4618-8D89-1DFFD059DAEE} 3276
                3⤵
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:3532
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2532
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored ignored ignored ignored
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3300
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{71CC97AA-C044-4D94-A4C3-AD3D807375EF} {A6E5ACFB-6980-478E-BB9D-3FBE8B742CBD} 3300
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4904
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3880
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4516
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{455C4E0E-841D-4158-A07E-37DFCFD46A2A} {8391D92B-619E-4A5C-B918-6B75A3701396} 4516
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:176
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1040 -ip 1040
            1⤵
              PID:4632
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
              1⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1004
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
                2⤵
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:220
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{F93818CA-DA67-45A2-A0F1-8A77AC10BADB} {FB3B8737-39D3-458E-82F4-4EF1B3A9AF8E} 220
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  PID:4260
            • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" /burn.runonce
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2364
              • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054804.log"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4632
                • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054804.log"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  PID:2928
                  • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
                    "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{7023356C-ED16-4963-A80E-2175A8304544} {D9B4C75D-04DC-49F1-95B3-C9594D8134D9} 2928
                    4⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:1404
                    • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1128 -burn.embedded BurnPipe.{253D0037-FC6F-4EAB-B074-7E219ACBCA49} {8909B903-B211-4C22-B59B-2A974B46721E} 1404
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:3028
                      • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={e7802eac-3305-4da0-9378-e55d1ed05518} -burn.filehandle.self=1128 -burn.embedded BurnPipe.{253D0037-FC6F-4EAB-B074-7E219ACBCA49} {8909B903-B211-4C22-B59B-2A974B46721E} 1404
                        6⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:4260
                        • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                          "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{74DB7E46-32B5-4A30-AC6A-D09222498BDF} {0BF94730-8314-4AEF-A5B6-628C6687B87B} 4260
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:3216
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 1140
                    4⤵
                    • Program crash
                    PID:5344
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5032
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
                2⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1172
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1ABAF7D1-1300-477E-B6EA-9825E5ADD0B3} {CEFAF86A-B420-4352-91F2-F22DCEDD4B2B} 1172
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  PID:936
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4332 -ip 4332
              1⤵
                PID:5544
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5676
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                  2⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5700
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{C67148CF-0528-4C48-BDDF-7E47968F05F9} {1B6D87A0-704E-458E-8AB2-3E90E150E40C} 5700
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    PID:5724
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5172
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                  2⤵
                  • Adds Run key to start application
                  PID:5216
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{51F9EADB-140C-49DE-B888-5DD34B9668DC} {307FEF48-711A-40EB-9003-CFE6CC175267} 5216
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    PID:2692
              • C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /burn.runonce
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5192
                • C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054809.log"
                  2⤵
                  • Executes dropped EXE
                  PID:5232
                  • C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054809.log"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:5176
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                1⤵
                • System Location Discovery: System Language Discovery
                PID:2420
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                  2⤵
                  • Adds Run key to start application
                  PID:1624
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6918408B-DA55-41FF-8E44-3E65B50396D9} {65DE4B77-2142-474B-ACA9-52526FDB5DC9} 1624
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of FindShellTrayWindow
                    PID:5636
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5796 -ip 5796
                1⤵
                  PID:5628
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  PID:5620
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    PID:5860
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1AB5196C-1A9C-4ADA-93F7-34DF35235090} {984A4DFD-9170-4F77-BBEE-E19FCB5973B9} 5860
                      3⤵
                      • Loads dropped DLL
                      • Suspicious use of FindShellTrayWindow
                      PID:5880
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                  1⤵
                  • System Location Discovery: System Language Discovery
                  PID:5168
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                    2⤵
                    • Adds Run key to start application
                    PID:3924
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{AF80E2FE-ED1E-4D06-8267-D934EE05C0A8} {C187BBD9-680F-48E4-9CEA-3BC670D99DC0} 3924
                      3⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:3848
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  1⤵
                    PID:2692
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                    1⤵
                      PID:5632
                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                        2⤵
                        • Adds Run key to start application
                        • System Location Discovery: System Language Discovery
                        PID:1912
                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{2CC21BEB-E6D9-4FB9-B57C-73C3589D7856} {0B30A363-8B2F-4EA5-AB2E-BF1E929A5102} 1912
                          3⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          PID:5548
                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                      1⤵
                        PID:4352
                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                          2⤵
                            PID:5836
                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{25316E48-D722-42DA-BAFF-3A56CB860F31} {F2090798-FFC1-4404-AD5B-8B52444D09A3} 5836
                              3⤵
                              • Loads dropped DLL
                              PID:5848
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2928 -ip 2928
                          1⤵
                            PID:5312

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                1
                                T1059

                                Windows Command Shell

                                1
                                T1059.003

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Installer Packages

                                1
                                T1546.016

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                1
                                T1546

                                Installer Packages

                                1
                                T1546.016

                                Defense Evasion

                                Modify Registry

                                1
                                T1112

                                System Binary Proxy Execution

                                1
                                T1218

                                Msiexec

                                1
                                T1218.007

                                Credential Access

                                Discovery

                                Peripheral Device Discovery

                                2
                                T1120

                                Query Registry

                                4
                                T1012

                                System Information Discovery

                                4
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Collection

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                e58b072.rbs
                                • Path C:\Config.Msi\e58b072.rbs
                                • Size 73KB
                                • SHA256 dd3fa3c36bb11143f587d2ce8dac0a46d63ecd90c091cf0151ecdd2dfa3ddabf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b077.rbs
                                • Path C:\Config.Msi\e58b077.rbs
                                • Size 73KB
                                • SHA256 fc99ffac932ef9ca0b60c44765bed898e9faa2528ed40bd19c7c38e4df0b2163
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b07c.rbs
                                • Path C:\Config.Msi\e58b07c.rbs
                                • Size 17KB
                                • SHA256 a7237cc2cf6093f024e7e8fa088a16d1588f9537cfb74515b96d3a74dd6d4fdb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b088.rbs
                                • Path C:\Config.Msi\e58b088.rbs
                                • Size 18KB
                                • SHA256 0b8e20a95e5d24e48506304ba1114cb8fb2c76af404491bdf7852cc615485917
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b091.rbs
                                • Path C:\Config.Msi\e58b091.rbs
                                • Size 14KB
                                • SHA256 4b38d91a40d0fae0e761497e4a88228633acaf570d57774c4fe070de50d05634
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b092.rbf
                                • Path C:\Config.Msi\e58b092.rbf
                                • Size 644KB
                                • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b093.rbf
                                • Path C:\Config.Msi\e58b093.rbf
                                • Size 940KB
                                • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b094.rbf
                                • Path C:\Config.Msi\e58b094.rbf
                                • Size 470KB
                                • SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b095.rbf
                                • Path C:\Config.Msi\e58b095.rbf
                                • Size 348KB
                                • SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b096.rbf
                                • Path C:\Config.Msi\e58b096.rbf
                                • Size 134KB
                                • SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b097.rbf
                                • Path C:\Config.Msi\e58b097.rbf
                                • Size 3B
                                • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                • MD5 SHA1 SHA512
                                Submit Download

                                e58b09b.rbs
                                • Path C:\Config.Msi\e58b09b.rbs
                                • Size 26KB
                                • SHA256 bdf9ae72bb7210bdcb73256181cec60776a26521d337c078d6088885df804dc6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0ad.rbs
                                • Path C:\Config.Msi\e58b0ad.rbs
                                • Size 22KB
                                • SHA256 b251922d089f49351f1df73c8044f0d6963a42a8a45033e46e9d2b19e6672097
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0ae.rbf
                                • Path C:\Config.Msi\e58b0ae.rbf
                                • Size 45KB
                                • SHA256 5e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0af.rbf
                                • Path C:\Config.Msi\e58b0af.rbf
                                • Size 45KB
                                • SHA256 9eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b0.rbf
                                • Path C:\Config.Msi\e58b0b0.rbf
                                • Size 73KB
                                • SHA256 550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b1.rbf
                                • Path C:\Config.Msi\e58b0b1.rbf
                                • Size 63KB
                                • SHA256 d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b2.rbf
                                • Path C:\Config.Msi\e58b0b2.rbf
                                • Size 72KB
                                • SHA256 87e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b3.rbf
                                • Path C:\Config.Msi\e58b0b3.rbf
                                • Size 73KB
                                • SHA256 b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b4.rbf
                                • Path C:\Config.Msi\e58b0b4.rbf
                                • Size 71KB
                                • SHA256 271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b5.rbf
                                • Path C:\Config.Msi\e58b0b5.rbf
                                • Size 52KB
                                • SHA256 43cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b6.rbf
                                • Path C:\Config.Msi\e58b0b6.rbf
                                • Size 52KB
                                • SHA256 32dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b7.rbf
                                • Path C:\Config.Msi\e58b0b7.rbf
                                • Size 69KB
                                • SHA256 1154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b8.rbf
                                • Path C:\Config.Msi\e58b0b8.rbf
                                • Size 4.2MB
                                • SHA256 6130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0b9.rbf
                                • Path C:\Config.Msi\e58b0b9.rbf
                                • Size 4.2MB
                                • SHA256 68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0ba.rbf
                                • Path C:\Config.Msi\e58b0ba.rbf
                                • Size 81KB
                                • SHA256 8c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0bb.rbf
                                • Path C:\Config.Msi\e58b0bb.rbf
                                • Size 81KB
                                • SHA256 d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0d4.rbs
                                • Path C:\Config.Msi\e58b0d4.rbs
                                • Size 16KB
                                • SHA256 7c7a94c46963ca1a9f44c76e93ad1a1f9d88db197cd0ebd1709c95f281d27967
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0d9.rbs
                                • Path C:\Config.Msi\e58b0d9.rbs
                                • Size 18KB
                                • SHA256 cf35a8d316050ae03b9e60936f03b8865ae32ca6874197b86d77d9c18a1064be
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0e6.rbs
                                • Path C:\Config.Msi\e58b0e6.rbs
                                • Size 20KB
                                • SHA256 b7f0b1e76ad6dac0a4c45c604adaa677844b7709629ac49254e2f5111f2e065a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                e58b0f5.rbs
                                • Path C:\Config.Msi\e58b0f5.rbs
                                • Size 19KB
                                • SHA256 83117bdb3b1a836c0008958c0510123b1fe50a772b1d2c7ed3ca88cd627d43ca
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                state.rsm
                                • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                • Size 618B
                                • SHA256 e9c480dd9637882b633d1e0b01431d27183b4f94be88d84c7b92c36ff9a342b1
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                state.rsm
                                • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                • Size 622B
                                • SHA256 3adf326101d67ae1d494164798315feda25349987a1563a7003f0eccfaf938e0
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                state.rsm
                                • Path C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\state.rsm
                                • Size 762B
                                • SHA256 d14e39423fae0740d3ef590e4225a08ecfc1435a16dde38ad1636b7b1e87eff7
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                state.rsm
                                • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm
                                • Size 618B
                                • SHA256 e0cea9d09f0aa00bb707ddf88135c718eea252e9adc689d4e5d33cb15689108c
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                vcredis1.cab
                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                • Size 247KB
                                • SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcredis1.cab
                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                • Size 312KB
                                • SHA256 20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcredist.msi
                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                • Size 2.6MB
                                • SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcredist.msi
                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                • Size 3.0MB
                                • SHA256 200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_amd64_20260823054750.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log
                                • Size 4KB
                                • SHA256 20284d34bbd0781522221b1094eec8cffeeca617f107509f2bc3b7ff0f5f0bb9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_amd64_20260823054750.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log
                                • Size 8KB
                                • SHA256 56fb76833e2c5295bf792b8968d227526e0be8205919c4ea7cbc030e472e88b5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_amd64_20260823054750.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log
                                • Size 12KB
                                • SHA256 b4cb55808fdbb4c57601f7e4bef29e9a754472bd3413dd3294e085c62983cf61
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_amd64_20260823054750.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log
                                • Size 16KB
                                • SHA256 d2b6d3d4a10fc6f8b8617321dc1100c5b59c15027e6ae9dc6e5f41bb65685341
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_amd64_20260823054750.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054750.log
                                • Size 23KB
                                • SHA256 f743d44dc90f849eb358021247ada1b8e1fe64c492e8073affa9fd3e11729b9c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_amd64_20260823054757_000_vcRuntimeMinimum_x64.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054757_000_vcRuntimeMinimum_x64.log
                                • Size 2KB
                                • SHA256 6a0eb0cc502aeca0ea716aef63f1ab0f23a68af98b7176a8345d34a9b9f48ed9
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                dd_vcredist_x86_20260823054749.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log
                                • Size 8KB
                                • SHA256 5a60ae0cb51f9f2a63925976a44903893d4ac89d35de2e2e930588c4f7113666
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_x86_20260823054749.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log
                                • Size 12KB
                                • SHA256 255feadf80a5ddbfe9dd3f1db6613e98485a194d284c7cf4cb3168919736bcb9
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_x86_20260823054749.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log
                                • Size 15KB
                                • SHA256 d60e7b7eadb598a017d08949819e16275b2d3fad7275ee1a3f3f90cb434f4160
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_x86_20260823054749.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log
                                • Size 19KB
                                • SHA256 3f16e887fbf2a08bdd65a99e28c745d1a40e5cb3880335d488d8c9a67fc3692f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_x86_20260823054749.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054749.log
                                • Size 26KB
                                • SHA256 b97cba44b0e84df102b40790edf99df8a157f19691a7693f847cc50c8b2f10c2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_x86_20260823054751.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054751.log
                                • Size 7KB
                                • SHA256 bd71f901aa3be5ee57564a1218ae612123b11b34ee3986e2a609e468abf7d0dd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                dd_vcredist_x86_20260823054751_000_vcRuntimeMinimum_x86.log
                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054751_000_vcRuntimeMinimum_x86.log
                                • Size 2KB
                                • SHA256 1ce398edac8950f04a3abd44ee3df833380fb987e1532aa8694e62e3509bc377
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
                                • Size 6KB
                                • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcredist_x64.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe
                                • Size 455KB
                                • SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                • Size 5.3MB
                                • SHA256 1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cab5046A8AB272BF37297BB7928664C9503
                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503
                                • Size 1010KB
                                • SHA256 e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcRuntimeAdditional_x64
                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64
                                • Size 140KB
                                • SHA256 8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcRuntimeMinimum_x64
                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64
                                • Size 140KB
                                • SHA256 e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                BootstrapperApplicationData.xml
                                • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\BootstrapperApplicationData.xml
                                • Size 3KB
                                • SHA256 ef0085c0476fbe4d6d170c6909f4ad35762fb05e125e9ed707b3c413ae6bbc74
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxl
                                • Size 2KB
                                • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                thm.xml
                                • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.xml
                                • Size 5KB
                                • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wixstdba.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\wixstdba.dll
                                • Size 117KB
                                • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcredist_x86.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.be\vcredist_x86.exe
                                • Size 455KB
                                • SHA256 fd597b58a578cfa46e1818b3b4b795ca6d25225dc11ee86cd491f3d55d7b235d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cab54A5CABBE7274D8A22EB58060AAB7623
                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cab54A5CABBE7274D8A22EB58060AAB7623
                                • Size 973KB
                                • SHA256 80a29d5ce27c6794b9a38e5d5b98d535f877ac3363f450ee7ac0be9394426e49
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cabB3E1576D1FEFBB979E13B1A5379E0B16
                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                                • Size 4.7MB
                                • SHA256 e12efc1bc0c61a7b9ba10a07502ef6833297d028368760da26e63218b744da79
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcRuntimeAdditional_x86
                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcRuntimeAdditional_x86
                                • Size 140KB
                                • SHA256 7cef0419f52c47f41b9546065e6788f20de07a7f1e647589ab52d88f6c7e50a5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                vcRuntimeMinimum_x86
                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcRuntimeMinimum_x86
                                • Size 140KB
                                • SHA256 60714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                BootstrapperApplicationData.xml
                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\BootstrapperApplicationData.xml
                                • Size 3KB
                                • SHA256 ed6e836d0ff4648d8464f7f63d2a8f0a10f6fbcee52a92449580d6f7c0238671
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\license.rtf
                                • Size 47KB
                                • SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                logo.png
                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\logo.png
                                • Size 1KB
                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                wixstdba.dll
                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\wixstdba.dll
                                • Size 126KB
                                • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                MSIBB5C.tmp
                                • Path C:\Windows\Installer\MSIBB5C.tmp
                                • Size 28KB
                                • SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1028\license.rtf
                                • Size 17KB
                                • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1028\thm.wxl
                                • Size 2KB
                                • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1029\license.rtf
                                • Size 12KB
                                • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1029\thm.wxl
                                • Size 3KB
                                • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1031\license.rtf
                                • Size 12KB
                                • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1031\thm.wxl
                                • Size 3KB
                                • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1036\license.rtf
                                • Size 12KB
                                • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1036\thm.wxl
                                • Size 3KB
                                • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1040\license.rtf
                                • Size 11KB
                                • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1040\thm.wxl
                                • Size 3KB
                                • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1041\license.rtf
                                • Size 29KB
                                • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1041\thm.wxl
                                • Size 3KB
                                • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1042\license.rtf
                                • Size 27KB
                                • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1042\thm.wxl
                                • Size 3KB
                                • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1045\license.rtf
                                • Size 13KB
                                • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1045\thm.wxl
                                • Size 3KB
                                • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1046\license.rtf
                                • Size 10KB
                                • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1046\thm.wxl
                                • Size 3KB
                                • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1049\license.rtf
                                • Size 31KB
                                • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1049\thm.wxl
                                • Size 4KB
                                • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1055\license.rtf
                                • Size 13KB
                                • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\1055\thm.wxl
                                • Size 3KB
                                • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\2052\license.rtf
                                • Size 17KB
                                • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\2052\thm.wxl
                                • Size 2KB
                                • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\3082\license.rtf
                                • Size 10KB
                                • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.wxl
                                • Path C:\Windows\Temp\{8C6736D3-A0F0-472E-BE1B-78B4C37423F5}\.ba\3082\thm.wxl
                                • Size 3KB
                                • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                license.rtf
                                • Path C:\Windows\Temp\{E2021DA6-7CE5-4FE3-9412-FE399D5B2420}\.ba\license.rtf
                                • Size 9KB
                                • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                thm.xml
                                • Path C:\Windows\Temp\{E2021DA6-7CE5-4FE3-9412-FE399D5B2420}\.ba\thm.xml
                                • Size 8KB
                                • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                wixstdba.dll
                                • Path C:\Windows\Temp\{E2021DA6-7CE5-4FE3-9412-FE399D5B2420}\.ba\wixstdba.dll
                                • Size 215KB
                                • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VC_redist.x64.exe
                                • Path C:\Windows\Temp\{E2021DA6-7CE5-4FE3-9412-FE399D5B2420}\.be\VC_redist.x64.exe
                                • Size 670KB
                                • SHA256 270fa05033b8b9455bd0d38924b1f1f3e4d3e32565da263209d1f9698effbc05
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                VC_redist.x86.exe
                                • Path C:\Windows\Temp\{FFB0D39D-65C6-44FA-8F4C-B356F85408A0}\.be\VC_redist.x86.exe
                                • Size 669KB
                                • SHA256 169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                metadata-2
                                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                • Size 24.1MB
                                • SHA256 529fe73c4967aa195857d490f29d34e4b220b458af754bc6d51171cf250f16dd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                {ffec5f03-2408-4cfd-a48a-0ad8553960c3}_OnDiskSnapshotProp
                                • Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ffec5f03-2408-4cfd-a48a-0ad8553960c3}_OnDiskSnapshotProp
                                • Size 6KB
                                • SHA256 7f9cd15186c4c4a96711c73b8c7c0c5a4dbc8d6be300f6a9ff0f58088dc904bd
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/1684-942-0x0000000000B00000-0x0000000000B65000-memory.dmp
                                Download

                                memory/3028-1319-0x0000000000B50000-0x0000000000BC7000-memory.dmp
                                Download

                                memory/3216-1316-0x0000000000B50000-0x0000000000BC7000-memory.dmp
                                Download

                                memory/3404-943-0x0000000000B00000-0x0000000000B65000-memory.dmp
                                Download

                                memory/4260-1318-0x0000000000B50000-0x0000000000BC7000-memory.dmp
                                Download