Overview

overview

10

Static

static

5

Gereksinim...ll.bat

windows10-2004-x64

7

Gereksinim...ll.bat

windows11-ltsc_2024-x64

7

Gereksinim...64.exe

windows10-2004-x64

7

Gereksinim...64.exe

windows11-ltsc_2024-x64

7

Gereksinim...86.exe

windows10-2004-x64

7

Gereksinim...86.exe

windows11-ltsc_2024-x64

7

Gereksinim...64.exe

windows10-2004-x64

3

Gereksinim...64.exe

windows11-ltsc_2024-x64

3

Gereksinim...86.exe

windows10-2004-x64

3

Gereksinim...86.exe

windows11-ltsc_2024-x64

3

Gereksinim...64.exe

windows10-2004-x64

3

Gereksinim...64.exe

windows11-ltsc_2024-x64

3

Gereksinim...86.exe

windows10-2004-x64

3

Gereksinim...86.exe

windows11-ltsc_2024-x64

3

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...64.exe

windows10-2004-x64

4

Gereksinim...64.exe

windows11-ltsc_2024-x64

4

Gereksinim...86.exe

windows10-2004-x64

4

Gereksinim...86.exe

windows11-ltsc_2024-x64

4

Gereksinim...er.bat

windows10-2004-x64

3

Gereksinim...er.bat

windows11-ltsc_2024-x64

3

Gereksinim...gs.vbs

windows10-2004-x64

5

Gereksinim...gs.vbs

windows11-ltsc_2024-x64

5

Gereksinim...ol.exe

windows10-2004-x64

5

Gereksinim...ol.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    87s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Gereksinimler ROVİDA/AIO/install_all.bat
  • Size 1KB
  • Sample260823-e88mysxwe1
  • SHA256 492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17
  • MD5 SHA1 SHA512 TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 27 IoCs
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 46 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\install_all.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x86.exe
      vcredist2005_x86.exe /q
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Badlisted process makes network request
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:1284
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2005_x64.exe
      vcredist2005_x64.exe /q
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\msiexec.exe
        msiexec /i vcredist.msi
        3⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:2296
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2008_x86.exe
      vcredist2008_x86.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4560
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2008_x64.exe
      vcredist2008_x64.exe /qb
      2⤵
      • System Location Discovery: System Language Discovery
      PID:200
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2010_x86.exe
      vcredist2010_x86.exe /passive /norestart
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2780
    • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2010_x64.exe
      vcredist2010_x64.exe /passive /norestart
      2⤵
        PID:1260
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x86.exe
        vcredist2012_x86.exe /passive /norestart
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x86.exe
          "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{30BD1A85-C377-46D0-A328-C90DA50AA3A7} {ACE18BB7-8546-43CE-95CD-847F1BAA8D69} 4588
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:5628
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x64.exe
        vcredist2012_x64.exe /passive /norestart
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2012_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{9C6FA61F-1FD5-48C4-B759-B2A77A98557D} {3D52FF98-5107-46A3-98FC-A190DB9242D6} 2568
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:5964
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x86.exe
        vcredist2013_x86.exe /passive /norestart
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4148
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x86.exe
          "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{BDCDC511-D703-4797-A09E-53A9B228D404} {42A162BA-D6F2-4F46-BD31-A2AC94DC6B9A} 4148
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:632
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x64.exe
        vcredist2013_x64.exe /passive /norestart
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3192
        • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x64.exe
          "C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2013_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{74A64D37-790C-4438-8D8F-6B12DFCD4B6D} {DFBD1FB2-EA11-42B0-8EC5-C7EB714ABACD} 3192
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:3368
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x86.exe
        vcredist2015_2017_2019_2022_x86.exe /passive /norestart
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\Temp\{55D427ED-E316-44BE-854C-32672810C79B}\.cr\vcredist2015_2017_2019_2022_x86.exe
          "C:\Windows\Temp\{55D427ED-E316-44BE-854C-32672810C79B}\.cr\vcredist2015_2017_2019_2022_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x86.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /passive /norestart
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3716
          • C:\Windows\Temp\{0666AAAC-C937-4E6D-87BD-2126FCBACF2F}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{0666AAAC-C937-4E6D-87BD-2126FCBACF2F}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D3F788DF-2109-41D4-A224-3C4894F6207B} {F25D66B9-969B-4C10-9B97-1EC47992197E} 3716
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            PID:4980
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 1360
            4⤵
            • Program crash
            PID:4324
      • C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x64.exe
        vcredist2015_2017_2019_2022_x64.exe /passive /norestart
        2⤵
          PID:5644
          • C:\Windows\Temp\{CF0FDEDB-65AC-42B6-9C1B-4BDBF788DF30}\.cr\vcredist2015_2017_2019_2022_x64.exe
            "C:\Windows\Temp\{CF0FDEDB-65AC-42B6-9C1B-4BDBF788DF30}\.cr\vcredist2015_2017_2019_2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Gereksinimler ROVİDA\AIO\vcredist2015_2017_2019_2022_x64.exe" -burn.filehandle.attached=760 -burn.filehandle.self=764 /passive /norestart
            3⤵
              PID:1244
              • C:\Windows\Temp\{524CE782-3EB3-4C4F-A8E3-2BC7B70BFE5B}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{524CE782-3EB3-4C4F-A8E3-2BC7B70BFE5B}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FD7EB1B8-93D6-4E29-8B72-5E06C93B8B83} {5CAF0C11-A784-4F76-988D-26EC26E11785} 1244
                4⤵
                  PID:2768
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 1624
                  4⤵
                  • Program crash
                  PID:4560
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Enumerates connected drives
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1872
            • C:\Windows\system32\srtasks.exe
              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2496
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding BE2C321D5682BFAEAA14ABFCCC945118
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4492
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 02289BCD6600487F7F35BC422A171259
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:676
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:264
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2560
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6076
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored -burn.unelevated BurnPipe.{40BA1CF9-9F34-48FC-9C5E-8AD26142AB95} {C0FB7131-8B1F-4299-A54C-D5D7BB9FC57A} 6076
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:1616
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4360
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6024
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{63AA2136-F812-41E8-B4F4-257D5A5C98B9} {FA025746-B018-4EDB-A382-7591AF5069F3} 6024
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:3900
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1008
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored
              2⤵
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:3704
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored -burn.unelevated BurnPipe.{B1A3FFD3-F1BA-49A4-BE5B-05332E3B6D2A} {4748E881-5B05-4FC6-A7D6-C2BE5A1112EE} 3704
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:4256
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2608
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4584
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{24CD6794-866B-4407-B583-01FEC9F52501} {D7376143-51C8-46F6-9D63-71C9482ECBD4} 4584
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:3276
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored /burn.runonce
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:3080
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1392
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{522C8D1E-26F8-44BB-9158-83E12EFA5FFD} {11091B6B-3288-44F7-AE6E-B35A55F7D6CC} 1392
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:3192
          • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1324
            • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054813.log"
              2⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4436
              • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054813.log" -burn.unelevated BurnPipe.{BEDE302B-14EC-4AB6-993F-708E872B3631} {E58FE87C-6A9B-438F-BA3C-A32EFAB25E4F} 4436
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:4308
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1084
                  4⤵
                  • Program crash
                  PID:2768
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4896
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:3244
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{FB74F581-EBBA-4766-93C6-31A018FAA350} {30095B8C-108A-46BD-9875-F6C15904EFD1} 3244
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:5836
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1780
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5964
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{FFCF2922-06A1-4C35-A7F1-23A2815DEDE8} {4D1C3A38-BB73-48B8-9ACC-E98E1DB7A240} 5964
                3⤵
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:2256
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2068
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3528
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{42E45EBD-56A3-4DE1-9483-39AF9E52B89A} {B99E1581-1415-49CE-ACCC-29A15A742B80} 3528
                3⤵
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:2772
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4256
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4432
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{E427E76D-EE44-4ABA-9F92-F5C4E1798EED} {19620033-9060-4815-842B-9A75A62E8B0E} 4432
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:3348
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:5748
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:4172
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5A11A8EB-001C-4C87-B3B4-974755BD77A3} {19F9656D-7103-4E7D-805B-F167C1F86096} 4172
                3⤵
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:2796
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:3456
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2624
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6252846E-38B8-40CF-8FBE-4AEC44309475} {B5B3BDB9-3C09-4995-85D8-E5719556BC38} 2624
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:5820
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4552
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3848
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{626F7681-4C2C-415D-B090-0DD318300485} {8399AADD-C629-4333-920F-C2407D05CAD5} 3848
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:5424
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5600
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3352
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{36CC973A-8D7A-49D7-A244-E749AFCDA508} {7241E6E1-5D7F-422E-92A2-2A35CA0ED538} 3352
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:1320
          • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4844
            • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054821.log"
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1964
              • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054821.log" -burn.unelevated BurnPipe.{534295F6-2EBB-46D6-A342-9DB0F63F3E7E} {73BB6688-8E58-4CDF-8676-4DDA1F964E46} 1964
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3540
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 1004
                  4⤵
                  • Program crash
                  PID:1156
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3880
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4196
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7BDC0B2C-8B47-445C-AC95-BC97BC764781} {9BC79536-DBA2-4C30-9AD0-BD0DECC36E29} 4196
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:248
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
            1⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4800
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3348
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{365F4188-E761-4C25-B194-1604319EE728} {B00C514E-1EAF-410B-9956-936B9C1FC83B} 3348
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:4088
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            1⤵
              PID:3276
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
              1⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5204
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
                2⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4836
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{8130F670-7E02-4785-91C3-7BBADB127F8B} {7BA48C1A-2DE6-415B-9D8F-42C844A82C45} 4836
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  PID:4168
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:3852
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
                2⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2260
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7E22F472-5658-4C4E-89BE-129EA4B2AF55} {7C1C0F4F-BCC3-4FF2-A90B-A9014B6A2E3C} 2260
                  3⤵
                  • Loads dropped DLL
                  • Suspicious use of FindShellTrayWindow
                  PID:2796
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2072
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3160
                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A9B08152-3D0F-4A23-9568-C8B9834C48C9} {06E92498-3502-40F2-A5C1-659AB91A31CF} 3160
                  3⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2520
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                2⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5024
                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D42CBCF6-F055-4FB2-9E0D-15B1EA7CE0B5} {07E1D9DB-CE4E-4DC3-8CD1-2B4121B528F0} 5024
                  3⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:1352
            • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" /burn.runonce
              1⤵
                PID:240
                • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054827.log"
                  2⤵
                    PID:4072
                    • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
                      "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054827.log"
                      3⤵
                        PID:1260
                        • C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe
                          "C:\ProgramData\Package Cache\{e7802eac-3305-4da0-9378-e55d1ed05518}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{9403BAAA-57D9-45DC-97F2-16576A104195} {3ACC53B0-2477-448C-9DD2-C20C7B262610} 1260
                          4⤵
                            PID:5280
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4308 -ip 4308
                      1⤵
                        PID:4632
                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                        1⤵
                          PID:1128
                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                            2⤵
                              PID:3260
                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6FC2527D-0533-4886-8A96-DC43BCB005A4} {8D3DDF1D-59D3-4BA3-8E25-D60E74A7ABC9} 3260
                                3⤵
                                  PID:3760
                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                              1⤵
                                PID:1892
                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                  2⤵
                                    PID:1672
                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1EB796FD-6062-4E60-AB66-248A2DB0A04A} {369C1B16-FABB-4BAB-999F-328C1AB10B5C} 1672
                                      3⤵
                                        PID:2524
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3716 -ip 3716
                                    1⤵
                                      PID:4560
                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                      1⤵
                                        PID:5080
                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                          2⤵
                                            PID:5596
                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{E57191F8-7847-4F9E-8B20-B39D82331DDF} {D8E8E9D3-CD86-4910-9B5A-FE97CA200B1A} 5596
                                              3⤵
                                                PID:2356
                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                            1⤵
                                              PID:248
                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                2⤵
                                                  PID:4732
                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{DF1BD27D-28CC-4264-AA70-E626A4F8A016} {5C988E27-0F12-4F32-B0B8-1CE33A7E7A6B} 4732
                                                    3⤵
                                                      PID:3472
                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                  1⤵
                                                    PID:1452
                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                      2⤵
                                                        PID:3812
                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{044606A7-F455-4273-AA17-479F3EAA8D3A} {EFE25D78-E26A-4B46-A630-2FADD537EFE4} 3812
                                                          3⤵
                                                            PID:5048
                                                      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                        1⤵
                                                          PID:2532
                                                          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                            2⤵
                                                              PID:4160
                                                              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1F0DF190-2CF8-4E6F-8145-02FAE0D0A7C1} {261CA8FE-D320-4A68-8590-34261418E160} 4160
                                                                3⤵
                                                                  PID:3936
                                                            • C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
                                                              "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /burn.runonce
                                                              1⤵
                                                                PID:3620
                                                                • C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
                                                                  "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054833.log"
                                                                  2⤵
                                                                    PID:1512
                                                                    • C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
                                                                      "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054833.log"
                                                                      3⤵
                                                                        PID:4500
                                                                        • C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe
                                                                          "C:\ProgramData\Package Cache\{804e7d66-ccc2-4c12-84ba-476da31d103d}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{93FC3008-6D59-43A4-B9B0-C6BC4E304274} {4022EAFF-0C62-4B48-AC57-87ABE9BEC631} 4500
                                                                          4⤵
                                                                            PID:1428
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 1064
                                                                            4⤵
                                                                            • Program crash
                                                                            PID:2900
                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                      1⤵
                                                                        PID:5104
                                                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                          2⤵
                                                                            PID:5604
                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{68E9B764-F427-45CD-A292-0CAE35511A13} {927A1252-FFE6-4104-A15E-9DF347E60718} 5604
                                                                              3⤵
                                                                                PID:3940
                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                            1⤵
                                                                              PID:1808
                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                2⤵
                                                                                  PID:3624
                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{E07DF9B2-43A0-4212-8F2C-12B0FFD234DF} {4C98FA4D-97A9-4CCF-BE14-8C9A8E21F733} 3624
                                                                                    3⤵
                                                                                      PID:4620
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1244 -ip 1244
                                                                                  1⤵
                                                                                    PID:5532
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3540 -ip 3540
                                                                                    1⤵
                                                                                      PID:4536
                                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                      1⤵
                                                                                        PID:4492
                                                                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                          2⤵
                                                                                            PID:6100
                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{ECC40FF6-C372-43E6-91A0-A1A87B2AB1AB} {0C4CF8E8-7A50-4785-8473-4691303F74E1} 6100
                                                                                              3⤵
                                                                                                PID:3056
                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                            1⤵
                                                                                              PID:600
                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                2⤵
                                                                                                  PID:3580
                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5FB4F3B1-42E1-445F-8DB1-17E854712CAE} {E8950ACA-7908-4D21-853C-FF221F2AF958} 3580
                                                                                                    3⤵
                                                                                                      PID:4324
                                                                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                  1⤵
                                                                                                    PID:5424
                                                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                      2⤵
                                                                                                        PID:5444
                                                                                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A8A5656D-DDE2-4A21-99E9-813F8994C0F3} {95A09B77-7560-499F-BFEC-240315D57A15} 5444
                                                                                                          3⤵
                                                                                                            PID:5532
                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                        1⤵
                                                                                                          PID:3376
                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                            2⤵
                                                                                                              PID:3788
                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{633EB021-7C2E-4678-A30E-DE8BBBBF383D} {027259F3-6A2B-48F0-9B36-177746B76147} 3788
                                                                                                                3⤵
                                                                                                                  PID:2424
                                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                              1⤵
                                                                                                                PID:2736
                                                                                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                  2⤵
                                                                                                                    PID:3504
                                                                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{855BAEED-B20F-41D0-8440-1301E2A4D0D9} {A396BD96-58CF-4B75-9626-7CFE09534241} 3504
                                                                                                                      3⤵
                                                                                                                        PID:1496
                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                    1⤵
                                                                                                                      PID:2296
                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                        2⤵
                                                                                                                          PID:4376
                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{535A4FD4-413E-4252-A6E2-0BD5A1F18854} {E140D75A-4B70-4560-B753-3494D55B0D1A} 4376
                                                                                                                            3⤵
                                                                                                                              PID:5364
                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                          1⤵
                                                                                                                            PID:2968
                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                              2⤵
                                                                                                                                PID:3900
                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{B29BC967-9A61-4F40-B102-0B7C4F9F8973} {D7F69A5F-6F71-4218-9BD4-DC5E0A609B49} 3900
                                                                                                                                  3⤵
                                                                                                                                    PID:6104
                                                                                                                              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                1⤵
                                                                                                                                  PID:5628
                                                                                                                                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                    2⤵
                                                                                                                                      PID:5988
                                                                                                                                      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5C1BF3D4-CD1B-4514-A611-D4DC66E7123D} {77F3537C-90EF-41FB-82D4-921386B866CA} 5988
                                                                                                                                        3⤵
                                                                                                                                          PID:3660
                                                                                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                      1⤵
                                                                                                                                        PID:5328
                                                                                                                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                          2⤵
                                                                                                                                            PID:4904
                                                                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D407C6D1-1CBB-4C0D-92A4-4745E741F797} {30A737B6-EB76-4F9F-B4E1-400B0A457D72} 4904
                                                                                                                                              3⤵
                                                                                                                                                PID:952
                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                            1⤵
                                                                                                                                              PID:5428
                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                2⤵
                                                                                                                                                  PID:4336
                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{12A37469-762F-4994-BD7C-8FD51BAB04A7} {289C14E8-079F-489A-A3D1-CCE404E55A18} 4336
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5680
                                                                                                                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                  1⤵
                                                                                                                                                    PID:5608
                                                                                                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5184
                                                                                                                                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{12B51B28-06C1-4F4C-9BC5-24CFA894DE15} {EDD9D61D-A926-4DE5-AADB-6969475B7BEE} 5184
                                                                                                                                                          3⤵
                                                                                                                                                            PID:6128
                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5816
                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4120
                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{72295620-78E5-43B9-B17A-3F06E2D7EC3B} {724ABA6A-6D81-4393-9116-818CD0415D1F} 4120
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4744
                                                                                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5652
                                                                                                                                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1716
                                                                                                                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{23E2F568-6C06-46CE-8330-70301C3CE95C} {FA643C5A-0516-454D-8D73-918F1E4E4B42} 1716
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:632
                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5292
                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3804
                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{F47AE053-BE90-41BA-AE0C-EEF1A10FE02B} {5292CE69-3008-406E-B450-4F58A116EE55} 3804
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5168
                                                                                                                                                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4656
                                                                                                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2012
                                                                                                                                                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{42BE8C7E-C515-4F29-88EE-2B55CA4D92DD} {93B6744B-39EB-416C-B539-40DAE39C9427} 2012
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2592
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4500 -ip 4500
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1156
                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:5820
                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:1628
                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5280
                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{3D1D3C61-BE6C-460D-A30B-15D670D2198A} {FF61A15E-D69D-4A02-8EA9-77D1A61DF369} 5280
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:120
                                                                                                                                                                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4724
                                                                                                                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5248
                                                                                                                                                                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{DAF31B3F-C49F-4A35-9A1F-B60F5E98FB3C} {FA6EC97F-AAC5-4590-B1EB-AA1E0A3729FF} 5248
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2168
                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1488
                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{543893DF-F5A2-4C58-A151-F6EA2EC4FDA2} {5412A80D-6DB4-4E73-A55A-2FEE9733992E} 1488
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5CDA2CF7-2AB4-448C-ADB5-409ACDF1E360} {FF0EF4FC-7184-47F4-BCFA-4710F2F83952} 4292
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2780
                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D93CBDA3-A3BA-4ACD-A74B-08C2890A91C5} {64F1098C-0585-4C10-8891-525A360F3D59} 3136
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:632
                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2752
                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A5031C9B-F85F-46DC-8D4B-044B80DE50B8} {73BD681A-4D8F-481D-A953-DCB77187664B} 4808
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2004
                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4544
                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:936
                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7476D2C5-7E64-4F0F-9E4E-85029441A8C4} {E2FA0278-4D1B-47F0-B4E8-49074D5AF3D1} 936
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:2492
                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1484
                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{AC967AC0-F896-4E8A-B694-08D6640278C0} {DD207B59-7407-464C-9967-362D65877A41} 1484
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3840
                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5912
                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3776
                                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1CF430D3-1368-4A20-A6CD-A4437FF23295} {E9A8040A-CF09-41A7-ACD3-DD6E50F5E064} 3776
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:4204
                                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6146AEF6-B67B-40CF-ABAE-4CC7E3D2B52F} {300946F0-34DC-4FFE-BCC3-E68E2D941F45} 4204
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1208

                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                                                                                    Resource Development

                                                                                                                                                                                                                                                    Initial Access

                                                                                                                                                                                                                                                    Execution

                                                                                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1059

                                                                                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1059.003

                                                                                                                                                                                                                                                    Persistence

                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                    Installer Packages

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1546.016

                                                                                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1547

                                                                                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1547.001

                                                                                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1546

                                                                                                                                                                                                                                                    Installer Packages

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1546.016

                                                                                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1112

                                                                                                                                                                                                                                                    System Binary Proxy Execution

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1218

                                                                                                                                                                                                                                                    Msiexec

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1218.007

                                                                                                                                                                                                                                                    Credential Access

                                                                                                                                                                                                                                                    Discovery

                                                                                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                                                                                    2
                                                                                                                                                                                                                                                    T1120

                                                                                                                                                                                                                                                    Query Registry

                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                    T1012

                                                                                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                                                                                    3
                                                                                                                                                                                                                                                    T1082

                                                                                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1614

                                                                                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                                                                                    1
                                                                                                                                                                                                                                                    T1614.001

                                                                                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                                                                                    Collection

                                                                                                                                                                                                                                                    Command and Control

                                                                                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                                                                                    Impact

                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                    e5a19a1.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19a1.rbs
                                                                                                                                                                                                                                                    • Size 17KB
                                                                                                                                                                                                                                                    • SHA256 6cda1349e26086b4ad44e8e6e84a31d1a19c9e9156ce619dd612bd390bf7535d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19aa.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19aa.rbs
                                                                                                                                                                                                                                                    • Size 13KB
                                                                                                                                                                                                                                                    • SHA256 8e6517725889ba4e00b88335f7f4b95966ab223e80c80b310728140cb4603e48
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19ab.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19ab.rbf
                                                                                                                                                                                                                                                    • Size 444KB
                                                                                                                                                                                                                                                    • SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19ac.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19ac.rbf
                                                                                                                                                                                                                                                    • Size 948KB
                                                                                                                                                                                                                                                    • SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19ad.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19ad.rbf
                                                                                                                                                                                                                                                    • Size 331KB
                                                                                                                                                                                                                                                    • SHA256 c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19ae.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19ae.rbf
                                                                                                                                                                                                                                                    • Size 242KB
                                                                                                                                                                                                                                                    • SHA256 1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19af.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19af.rbf
                                                                                                                                                                                                                                                    • Size 117KB
                                                                                                                                                                                                                                                    • SHA256 62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19b0.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19b0.rbf
                                                                                                                                                                                                                                                    • Size 3B
                                                                                                                                                                                                                                                    • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19ba.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19ba.rbs
                                                                                                                                                                                                                                                    • Size 26KB
                                                                                                                                                                                                                                                    • SHA256 dc5f826ac32ce241646089c6b13a76fa128a6bf6e93d6e8e6137d42f4870ebbf
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19cc.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19cc.rbs
                                                                                                                                                                                                                                                    • Size 22KB
                                                                                                                                                                                                                                                    • SHA256 07d05fa4a37d836d4fed6577c7c8c96e81ce2153372c9403cea7c0ccc283988b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19cd.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19cd.rbf
                                                                                                                                                                                                                                                    • Size 45KB
                                                                                                                                                                                                                                                    • SHA256 5e7331a6adeb9d4252531ade800d47b8ddf020b97cfedc58de85386b3ae64e76
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19ce.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19ce.rbf
                                                                                                                                                                                                                                                    • Size 45KB
                                                                                                                                                                                                                                                    • SHA256 9eec79bd4af04bba1e11fc24c64d94f30c22985c8ebbce3e0b411a61a1edbabe
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19cf.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19cf.rbf
                                                                                                                                                                                                                                                    • Size 73KB
                                                                                                                                                                                                                                                    • SHA256 550f6c9f16fe85a8338b04f1bec43de3babeac60ff257197625f2802907007b8
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d0.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d0.rbf
                                                                                                                                                                                                                                                    • Size 63KB
                                                                                                                                                                                                                                                    • SHA256 d1dbc7677010f9af7b680ea2efa28c964154997bddbf6c8d9d65ea225a5ec613
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d1.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d1.rbf
                                                                                                                                                                                                                                                    • Size 72KB
                                                                                                                                                                                                                                                    • SHA256 87e5c496e038c337ca1acee52c145d8f4bdb3e74261b13e1feb740c4e2124e0a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d2.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d2.rbf
                                                                                                                                                                                                                                                    • Size 73KB
                                                                                                                                                                                                                                                    • SHA256 b098ed9a5f44052b9ab5ceee82ab4cea5c6d9a14a61816882ef996a0599838b2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d3.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d3.rbf
                                                                                                                                                                                                                                                    • Size 71KB
                                                                                                                                                                                                                                                    • SHA256 271abe43d14cbd8c80b85ec804787272522bc06c45b7f93244b718ab0c08a289
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d4.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d4.rbf
                                                                                                                                                                                                                                                    • Size 52KB
                                                                                                                                                                                                                                                    • SHA256 43cd9fdf714b7dfca4b2a8f54bc25ceeddc7a6212ba59233d89a03c650053407
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d5.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d5.rbf
                                                                                                                                                                                                                                                    • Size 52KB
                                                                                                                                                                                                                                                    • SHA256 32dfe0f26b5024ec900a31f0dde736ca62769dc5de48238b485f4322cd367e7d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d6.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d6.rbf
                                                                                                                                                                                                                                                    • Size 69KB
                                                                                                                                                                                                                                                    • SHA256 1154c537bd700ebbda599a5c2923e73d098c3eaa930fd0f4d415583ff90eea67
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d7.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d7.rbf
                                                                                                                                                                                                                                                    • Size 4.2MB
                                                                                                                                                                                                                                                    • SHA256 6130ad7d21a492cd3f3924bed43d954f80b6b6920374934b9eed057f27130e15
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d8.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d8.rbf
                                                                                                                                                                                                                                                    • Size 4.2MB
                                                                                                                                                                                                                                                    • SHA256 68df186e26151313a0df2adb0ef5f3a45ebba3cb02229bd8723a29dee60e278d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19d9.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19d9.rbf
                                                                                                                                                                                                                                                    • Size 81KB
                                                                                                                                                                                                                                                    • SHA256 8c82f149507c3415250e52bf4c7fe937946a60d51f07492a1e36ab3e14482187
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19da.rbf
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19da.rbf
                                                                                                                                                                                                                                                    • Size 81KB
                                                                                                                                                                                                                                                    • SHA256 d6d2ba4ac1606e825216a25ab401d26d77c4300299e957cfadab3b0b945d065a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19e1.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19e1.rbs
                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                    • SHA256 5f834121cbae3ddf72a8346a0154de48685f035a8cc66a47ceb02260ad04aed2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19ed.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19ed.rbs
                                                                                                                                                                                                                                                    • Size 19KB
                                                                                                                                                                                                                                                    • SHA256 e0ee1ddfc1662a5684080fa9b73aa7fcb680db09f4d1936e848078eb06340a74
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a19fe.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a19fe.rbs
                                                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                                                    • SHA256 df82a0186dd931989311be4d5ec96f52e15bc7a435afb69383ed3d0afb8d028c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    e5a1a0d.rbs
                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e5a1a0d.rbs
                                                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                                                    • SHA256 35e7020b77110ef44d805e1c5bbe7893a54e1017117274b85cb5676fdde33990
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    state.rsm
                                                                                                                                                                                                                                                    • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                                                                                                                                                                                                                                    • Size 618B
                                                                                                                                                                                                                                                    • SHA256 681e5d2538121181b115f90693cfedccc860571ca0e58277d2997ff73c021fbe
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    state.rsm
                                                                                                                                                                                                                                                    • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm
                                                                                                                                                                                                                                                    • Size 618B
                                                                                                                                                                                                                                                    • SHA256 79dc343efa7b82b59c16a2a2cee6b6f1d46f28455a78e9b8cf95c5c163df1492
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcredis1.cab
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                                                                                                                                                                                                                                    • Size 247KB
                                                                                                                                                                                                                                                    • SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcredis1.cab
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                                                                                                                                                                                                                                    • Size 312KB
                                                                                                                                                                                                                                                    • SHA256 20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcredist.msi
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                                                                                                                                                                                                                                    • Size 2.6MB
                                                                                                                                                                                                                                                    • SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcredist.msi
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                                                                                                                                                                                                                                    • Size 3.0MB
                                                                                                                                                                                                                                                    • SHA256 200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                    • SHA256 c8ff5842a62c450a696d65e1ccfd3707478cba5a5f326197d20ded3060fd9bd4
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                    • SHA256 06c390627278ae8418273101febbc80c1c37cc6ccc787012970c12aeece4a5d3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                                                    • SHA256 1987a7c43e2c66009ea3cdfe38198fee7448d20029fa916607e29f1738f9144e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                    • SHA256 5fe37a0cdef6da193cbc0f11d23b71255fd0ee1b71a1eb603341b8ae15c2c21f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Size 20KB
                                                                                                                                                                                                                                                    • SHA256 13c0261e1ef333ee83c7a84720266de561a73fa9b2875ea1980e140a073923cf
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823054812.log
                                                                                                                                                                                                                                                    • Size 23KB
                                                                                                                                                                                                                                                    • SHA256 e76caeb1a2fecb61bfe0e63912cca9e81ef6861075b81604959678001ec0c915
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                    • SHA256 95fb9296f772cbb765a3a619455bad9ec4ccab1e7336f80c147db66dcf7dc8b5
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                    • SHA256 fb6c5ee6188059738da4590e876735e0a7409b71d8e92dd1950f3f8dd2c8a484
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Size 12KB
                                                                                                                                                                                                                                                    • SHA256 f00b54ddd6ea11b8fb032d5b022a7ae0b00dd7300bbab4ca1a6203a13161d6c3
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                                                                                    • SHA256 e2afe269faa4fac5ae0b182afa3415c41a12c50d17b52c411cac788ea4b5287e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Size 20KB
                                                                                                                                                                                                                                                    • SHA256 edd45435d32394eba26d590132aa9a349cd9b5fa83bcbf83a086718c0e3ce108
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Size 23KB
                                                                                                                                                                                                                                                    • SHA256 50220a28c459235abf679d244874d84cd776343bdb34ea978490c57044ad12b2
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054811.log
                                                                                                                                                                                                                                                    • Size 23KB
                                                                                                                                                                                                                                                    • SHA256 64355f72563524b3abfe87cad43006183f1e31d6d1540b0a4e80a51939c4da11
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054813.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054813.log
                                                                                                                                                                                                                                                    • Size 10KB
                                                                                                                                                                                                                                                    • SHA256 6b0cdd32541f713aa725adf15f0ece4459297c85d3419204fe7884b1a7228c48
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    dd_vcredist_x86_20260823054813_000_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260823054813_000_vcRuntimeMinimum_x86.log
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 393138c11a30951dcc991739b782af9a01a61c6a2a7504d97b7ad64b879da503
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    license.rtf
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                    • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcredist_x64.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.be\vcredist_x64.exe
                                                                                                                                                                                                                                                    • Size 455KB
                                                                                                                                                                                                                                                    • SHA256 102f69b5a98352a6a1a6b26bc2c86ee7611c1f45f5a9ca04f5a8841961f191c6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    cab5046A8AB272BF37297BB7928664C9503
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\cab5046A8AB272BF37297BB7928664C9503
                                                                                                                                                                                                                                                    • Size 1010KB
                                                                                                                                                                                                                                                    • SHA256 e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcRuntimeAdditional_x64
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeAdditional_x64
                                                                                                                                                                                                                                                    • Size 140KB
                                                                                                                                                                                                                                                    • SHA256 8909e5c1d917064983595a4e4717f758c2a8df8f59d7b31a5b79b2f95bd8f7cc
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcRuntimeMinimum_x64
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcRuntimeMinimum_x64
                                                                                                                                                                                                                                                    • Size 140KB
                                                                                                                                                                                                                                                    • SHA256 e88d0915814e622cd1deca849efa23a0d58d5d756be44ebbb4d460d3dac9e816
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 ef0085c0476fbe4d6d170c6909f4ad35762fb05e125e9ed707b3c413ae6bbc74
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    logo.png
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                    • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    thm.wxl
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.wxl
                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                    • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    thm.xml
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\thm.xml
                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                    • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    wixstdba.dll
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
                                                                                                                                                                                                                                                    • Size 126KB
                                                                                                                                                                                                                                                    • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    wixstdba.dll
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba1\wixstdba.dll
                                                                                                                                                                                                                                                    • Size 117KB
                                                                                                                                                                                                                                                    • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcredist_x86.exe
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.be\vcredist_x86.exe
                                                                                                                                                                                                                                                    • Size 455KB
                                                                                                                                                                                                                                                    • SHA256 fd597b58a578cfa46e1818b3b4b795ca6d25225dc11ee86cd491f3d55d7b235d
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    cab54A5CABBE7274D8A22EB58060AAB7623
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cab54A5CABBE7274D8A22EB58060AAB7623
                                                                                                                                                                                                                                                    • Size 973KB
                                                                                                                                                                                                                                                    • SHA256 80a29d5ce27c6794b9a38e5d5b98d535f877ac3363f450ee7ac0be9394426e49
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    cabB3E1576D1FEFBB979E13B1A5379E0B16
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                                                                                                                                                                                                                                                    • Size 4.7MB
                                                                                                                                                                                                                                                    • SHA256 e12efc1bc0c61a7b9ba10a07502ef6833297d028368760da26e63218b744da79
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcRuntimeAdditional_x86
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcRuntimeAdditional_x86
                                                                                                                                                                                                                                                    • Size 140KB
                                                                                                                                                                                                                                                    • SHA256 7cef0419f52c47f41b9546065e6788f20de07a7f1e647589ab52d88f6c7e50a5
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    vcRuntimeMinimum_x86
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcRuntimeMinimum_x86
                                                                                                                                                                                                                                                    • Size 140KB
                                                                                                                                                                                                                                                    • SHA256 60714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                    • SHA256 ed6e836d0ff4648d8464f7f63d2a8f0a10f6fbcee52a92449580d6f7c0238671
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    license.rtf
                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\license.rtf
                                                                                                                                                                                                                                                    • Size 47KB
                                                                                                                                                                                                                                                    • SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    MSI2154.tmp
                                                                                                                                                                                                                                                    • Path C:\Windows\Installer\MSI2154.tmp
                                                                                                                                                                                                                                                    • Size 28KB
                                                                                                                                                                                                                                                    • SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    msvcp120.dll
                                                                                                                                                                                                                                                    • Path C:\Windows\System32\msvcp120.dll
                                                                                                                                                                                                                                                    • Size 644KB
                                                                                                                                                                                                                                                    • SHA256 3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    msvcr120.dll
                                                                                                                                                                                                                                                    • Path C:\Windows\System32\msvcr120.dll
                                                                                                                                                                                                                                                    • Size 940KB
                                                                                                                                                                                                                                                    • SHA256 753ac30c30aae62415cc225e3d057b8b6254afe280696e0a43f1a7c3132632a6
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    VC_redist.x86.exe
                                                                                                                                                                                                                                                    • Path C:\Windows\Temp\{0666AAAC-C937-4E6D-87BD-2126FCBACF2F}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                                                    • Size 669KB
                                                                                                                                                                                                                                                    • SHA256 169b8f7025b301ffce5402c98c07f9e01bbadce52a2961175b777279f92624a7
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    license.rtf
                                                                                                                                                                                                                                                    • Path C:\Windows\Temp\{524CE782-3EB3-4C4F-A8E3-2BC7B70BFE5B}\.ba\license.rtf
                                                                                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                                                                                    • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    thm.xml
                                                                                                                                                                                                                                                    • Path C:\Windows\Temp\{524CE782-3EB3-4C4F-A8E3-2BC7B70BFE5B}\.ba\thm.xml
                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                    • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    wixstdba.dll
                                                                                                                                                                                                                                                    • Path C:\Windows\Temp\{524CE782-3EB3-4C4F-A8E3-2BC7B70BFE5B}\.ba\wixstdba.dll
                                                                                                                                                                                                                                                    • Size 215KB
                                                                                                                                                                                                                                                    • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    VC_redist.x64.exe
                                                                                                                                                                                                                                                    • Path C:\Windows\Temp\{524CE782-3EB3-4C4F-A8E3-2BC7B70BFE5B}\.be\VC_redist.x64.exe
                                                                                                                                                                                                                                                    • Size 670KB
                                                                                                                                                                                                                                                    • SHA256 270fa05033b8b9455bd0d38924b1f1f3e4d3e32565da263209d1f9698effbc05
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    metadata-2
                                                                                                                                                                                                                                                    • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                                                                                                                                                                                    • Size 26.1MB
                                                                                                                                                                                                                                                    • SHA256 3e8522b9c8daff2d40e24b464b0713b3f28ad9a8857ddac72c73715b08706c7b
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    {62b7c043-4148-4660-9d99-280b787bad21}_OnDiskSnapshotProp
                                                                                                                                                                                                                                                    • Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{62b7c043-4148-4660-9d99-280b787bad21}_OnDiskSnapshotProp
                                                                                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                                                                                    • SHA256 dd8037afb76bb5ba1f95e2170dd842da86d4c7e9f937f7ffc0191a8d438af2aa
                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                    memory/1260-1533-0x00000000001B0000-0x0000000000229000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1964-1064-0x0000000000900000-0x0000000000965000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/1964-1305-0x0000000000900000-0x0000000000965000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3540-1130-0x0000000000900000-0x0000000000965000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/3540-1293-0x0000000000900000-0x0000000000965000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4072-1534-0x00000000001B0000-0x0000000000229000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4308-672-0x0000000000890000-0x00000000008F5000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4308-935-0x0000000000890000-0x00000000008F5000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4436-1193-0x0000000000890000-0x00000000008F5000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/4436-671-0x0000000000890000-0x00000000008F5000-memory.dmp
                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                    memory/5280-1532-0x00000000001B0000-0x0000000000229000-memory.dmp
                                                                                                                                                                                                                                                    Download