5ec95073eb12eebd04230bfd1f6840b7a6aebf3f627e0f2f825505b8fd823257

Analysis

max time kernel
102s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fix.exe
Size 67KB
Sample260908-xnbrlaxcld
SHA256 5ec95073eb12eebd04230bfd1f6840b7a6aebf3f627e0f2f825505b8fd823257
MD5 a9d917e60e7d4f15bb4cea593185067e
SHA1 067c3179c7aae49d46ca5979c8fe733f70ced128
SHA512 3fa2382a8d23594bd8f8b954ecaa9b817e4851dacc4bbcd98af28a7609462d81da5a2378fe0a1bd3c6c00a4a9b811a7ed446fe92e98482f2dcee95807a264b4d
SSDEEP 1536:gJ93HPVecggIloUJsDucwMVyrYVHD3Xtxs:gJ93vYMI1cxVyrYVHD3Xtxs
TLSH
T15963309D722072DFC857C4729EA82CA8FA5174BB871F8607A42716EDDA0D897DF140F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
6	2396	Fix.exe

Executes dropped EXE 1 IoCs

pid	Process
4544	VisualCppRedist_AIO_x86_x64.exe

Loads dropped DLL 42 IoCs

pid	Process
3108	vcredist_x86.exe
4792	vcredist_x64.exe
1192	vcredist_x86.exe
2952	vcredist_x64.exe
4812	VC_redist.x86.exe
5264	VC_redist.x64.exe
1956	vcredist_x86.exe
4592	vcredist_x64.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
632	MsiExec.exe
1108	VC_redist.x86.exe
2668	MsiExec.exe
3236	MsiExec.exe
992	VC_redist.x64.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3028	MsiExec.exe
3844	MsiExec.exe
3936	MsiExec.exe
4448	MsiExec.exe
4448	MsiExec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
2100	cscript.exe
4696	cscript.exe
2084	cscript.exe
3484	cscript.exe
5704	cscript.exe
5528	cscript.exe
1724	cscript.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFC88D90FC43B362CF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39A1.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111874.0\mfc80CHT.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200111947.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200111935.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120772.0\9.0.30729.7523.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI134D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56FF665DDFBB4CA9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DFE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI50F4.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200111874.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120744.0\mfc90fra.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F2B.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111778.0\ATL80.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DFADA739A688FF53E1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7A6.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111968.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111980.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120730.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_942a41ec.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120748.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_b0616a48.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120767.0\9.0.30729.7523.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200120730.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F32.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8D911C39B7D28E5B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI52EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a04ab.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120737.0\mfc90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200120772.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAEDEFF9089EC93C0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2AF0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI530A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI581D.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200111794.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAF0418A8BB909E7E.TMP	msiexec.exe
File created	C:\Windows\dd_vcredist_x86_001_vcRuntimeMinimum_x86.log	vcredist_x86.exe
File opened for modification	C:\Windows\Installer\MSI2E9A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF27356C226788AFA8.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111778.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_d7470ca6.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111825.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111825.0\mfc80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111874.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120706.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_f4ca2f60.manifest	msiexec.exe
File opened for modification	C:\Windows\dd_vcredist_x86_001_vcRuntimeMinimum_x86.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4F8B.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111794.0\msvcp80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111874.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200111980.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200111992.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DF90468D7F5A1A013D.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120737.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_6510b4f1.manifest	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA3627FBC3EFDA6EB.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a04ab.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF82F1C5BDA722A673.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0CD7810ED8A47362.TMP	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260908200111968.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120744.0\amd64_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_d59128b1.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120737.0\mfcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260908200120730.0\msvcm90.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DFED08EB6F15FCF7B6.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3961.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4888	cmd.exe
5588	cmd.exe
6072	cmd.exe
3164	cmd.exe
3920	cmd.exe
712	cmd.exe
3860	cmd.exe
5928	cmd.exe
5244	cmd.exe
5152	cmd.exe
2732	cmd.exe
5128	cmd.exe
1720	cmd.exe
2616	cmd.exe
964	cmd.exe
3028	cmd.exe
3472	cmd.exe
1092	cmd.exe
4768	cmd.exe
1724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualCppRedist_AIO_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ffbf1fc65d8bbf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ffbf1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ffbf1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ffbf1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ffbf1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\AdvertiseFlags = "388"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\15E8B87C56C0E773581D82F286F95E50	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1FB5F95B8C762083E895C25E153AF95C	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\8 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2010\\x64\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800360034003e007a00690065004e002100280039007d00770036007400490033006000700060003000240034006f0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8520DAD7C5154DD39846DB1714990E7F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e004b0039007000540041002700650026005d002900650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\11 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\Version = "201367252"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\\packages\\vcRuntimeAdditional_x86\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\0FC00402C7EDE723A94E0F3FD809588F	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\PackageCode = "68A95FBB029126F41BFBC3F3D2C9E359"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0064002a007400210037007b006e0040006c0033003f0069003000520056007000540037005900420000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2010\\x64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8520DAD7C5154DD39846DB1714990E7F\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\Dependents	vcredist_x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\Servicing_Key	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\PackageName = "vc_runtimeAdditional_x86.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media\1 = ";1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle\Dependents	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\4 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
5484	reg.exe
5828	reg.exe
3524	reg.exe
2520	reg.exe
4660	reg.exe
4820	reg.exe
5052	reg.exe
3524	reg.exe
2804	reg.exe
3388	reg.exe
1344	reg.exe
5292	reg.exe
480	reg.exe
5992	reg.exe
2500	reg.exe
5524	reg.exe
5980	reg.exe
5664	reg.exe
2768	reg.exe
1240	reg.exe
2308	reg.exe
5316	reg.exe
3900	reg.exe
5664	reg.exe
708	reg.exe
736	reg.exe
3588	reg.exe
3940	reg.exe
2768	reg.exe
984	reg.exe
5200	reg.exe
1120	reg.exe
5284	reg.exe
5748	reg.exe
1940	reg.exe
4584	reg.exe
4560	reg.exe
3080	reg.exe
4856	reg.exe
4980	reg.exe
2348	reg.exe
3476	reg.exe
2812	reg.exe
3248	reg.exe
3396	reg.exe
2472	reg.exe
5020	reg.exe
940	reg.exe
736	reg.exe
4596	reg.exe
4532	reg.exe
4484	reg.exe
5832	reg.exe
2144	reg.exe
2480	reg.exe
1572	reg.exe
4704	reg.exe
5636	reg.exe
4280	reg.exe
5560	reg.exe
2660	reg.exe
1992	reg.exe
1416	reg.exe
772	reg.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
6020	WMIC.exe
6020	WMIC.exe
6020	WMIC.exe
6020	WMIC.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe
1500	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	Fix.exe
Token: SeIncreaseQuotaPrivilege	6020	WMIC.exe
Token: SeSecurityPrivilege	6020	WMIC.exe
Token: SeTakeOwnershipPrivilege	6020	WMIC.exe
Token: SeLoadDriverPrivilege	6020	WMIC.exe
Token: SeSystemProfilePrivilege	6020	WMIC.exe
Token: SeSystemtimePrivilege	6020	WMIC.exe
Token: SeProfSingleProcessPrivilege	6020	WMIC.exe
Token: SeIncBasePriorityPrivilege	6020	WMIC.exe
Token: SeCreatePagefilePrivilege	6020	WMIC.exe
Token: SeBackupPrivilege	6020	WMIC.exe
Token: SeRestorePrivilege	6020	WMIC.exe
Token: SeShutdownPrivilege	6020	WMIC.exe
Token: SeDebugPrivilege	6020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6020	WMIC.exe
Token: SeRemoteShutdownPrivilege	6020	WMIC.exe
Token: SeUndockPrivilege	6020	WMIC.exe
Token: SeManageVolumePrivilege	6020	WMIC.exe
Token: 33	6020	WMIC.exe
Token: 34	6020	WMIC.exe
Token: 35	6020	WMIC.exe
Token: 36	6020	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6020	WMIC.exe
Token: SeSecurityPrivilege	6020	WMIC.exe
Token: SeTakeOwnershipPrivilege	6020	WMIC.exe
Token: SeLoadDriverPrivilege	6020	WMIC.exe
Token: SeSystemProfilePrivilege	6020	WMIC.exe
Token: SeSystemtimePrivilege	6020	WMIC.exe
Token: SeProfSingleProcessPrivilege	6020	WMIC.exe
Token: SeIncBasePriorityPrivilege	6020	WMIC.exe
Token: SeCreatePagefilePrivilege	6020	WMIC.exe
Token: SeBackupPrivilege	6020	WMIC.exe
Token: SeRestorePrivilege	6020	WMIC.exe
Token: SeShutdownPrivilege	6020	WMIC.exe
Token: SeDebugPrivilege	6020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6020	WMIC.exe
Token: SeRemoteShutdownPrivilege	6020	WMIC.exe
Token: SeUndockPrivilege	6020	WMIC.exe
Token: SeManageVolumePrivilege	6020	WMIC.exe
Token: 33	6020	WMIC.exe
Token: 34	6020	WMIC.exe
Token: 35	6020	WMIC.exe
Token: 36	6020	WMIC.exe
Token: SeBackupPrivilege	3376	vssvc.exe
Token: SeRestorePrivilege	3376	vssvc.exe
Token: SeAuditPrivilege	3376	vssvc.exe
Token: SeBackupPrivilege	2400	srtasks.exe
Token: SeRestorePrivilege	2400	srtasks.exe
Token: SeSecurityPrivilege	2400	srtasks.exe
Token: SeTakeOwnershipPrivilege	2400	srtasks.exe
Token: SeShutdownPrivilege	2484	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	2484	vcredist_x86.exe
Token: SeSecurityPrivilege	1500	msiexec.exe
Token: SeCreateTokenPrivilege	2484	vcredist_x86.exe
Token: SeAssignPrimaryTokenPrivilege	2484	vcredist_x86.exe
Token: SeLockMemoryPrivilege	2484	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	2484	vcredist_x86.exe
Token: SeMachineAccountPrivilege	2484	vcredist_x86.exe
Token: SeTcbPrivilege	2484	vcredist_x86.exe
Token: SeSecurityPrivilege	2484	vcredist_x86.exe
Token: SeTakeOwnershipPrivilege	2484	vcredist_x86.exe
Token: SeLoadDriverPrivilege	2484	vcredist_x86.exe
Token: SeSystemProfilePrivilege	2484	vcredist_x86.exe
Token: SeSystemtimePrivilege	2484	vcredist_x86.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4544	VisualCppRedist_AIO_x86_x64.exe
3108	vcredist_x86.exe
4792	vcredist_x64.exe
1192	vcredist_x86.exe
2952	vcredist_x64.exe
4812	VC_redist.x86.exe
5264	VC_redist.x64.exe
1956	vcredist_x86.exe
4592	vcredist_x64.exe
4588	msiexec.exe
4588	msiexec.exe
1980	msiexec.exe
1108	VC_redist.x86.exe
1980	msiexec.exe
6116	msiexec.exe
6116	msiexec.exe
992	VC_redist.x64.exe
5376	msiexec.exe
5376	msiexec.exe
5716	msiexec.exe
5716	msiexec.exe
2696	msiexec.exe
2696	msiexec.exe
4296	msiexec.exe
4296	msiexec.exe
4236	msiexec.exe
4236	msiexec.exe
4696	msiexec.exe
4696	msiexec.exe
1144	msiexec.exe
1144	msiexec.exe
2792	msiexec.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
1500	msiexec.exe
4588	msiexec.exe
632	MsiExec.exe
1980	msiexec.exe
2668	MsiExec.exe
6116	msiexec.exe
3236	MsiExec.exe
5376	msiexec.exe
3028	MsiExec.exe
5716	msiexec.exe
3844	MsiExec.exe
2696	msiexec.exe
3936	MsiExec.exe
4296	msiexec.exe
4448	MsiExec.exe
4236	msiexec.exe
4696	msiexec.exe
1144	msiexec.exe
2792	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4544	2396	Fix.exe	90
PID 4544 wrote to memory of 3860	4544	VisualCppRedist_AIO_x86_x64.exe	91
PID 3860 wrote to memory of 5128	3860	cmd.exe	93
PID 5128 wrote to memory of 2472	5128	cmd.exe	94
PID 3860 wrote to memory of 4992	3860	cmd.exe	95
PID 3860 wrote to memory of 5368	3860	cmd.exe	96
PID 3860 wrote to memory of 3472	3860	cmd.exe	97
PID 3860 wrote to memory of 4588	3860	cmd.exe	98
PID 3860 wrote to memory of 6020	3860	cmd.exe	99
PID 3860 wrote to memory of 4964	3860	cmd.exe	100
PID 3860 wrote to memory of 1720	3860	cmd.exe	102
PID 1720 wrote to memory of 2784	1720	cmd.exe	103
PID 3860 wrote to memory of 1092	3860	cmd.exe	104
PID 1092 wrote to memory of 5404	1092	cmd.exe	105
PID 3860 wrote to memory of 5928	3860	cmd.exe	106
PID 5928 wrote to memory of 1212	5928	cmd.exe	222
PID 3860 wrote to memory of 5964	3860	cmd.exe	108
PID 3860 wrote to memory of 3416	3860	cmd.exe	224
PID 3860 wrote to memory of 4200	3860	cmd.exe	110
PID 3860 wrote to memory of 5424	3860	cmd.exe	111
PID 3860 wrote to memory of 4888	3860	cmd.exe	112
PID 4888 wrote to memory of 5704	4888	cmd.exe	229
PID 3860 wrote to memory of 2616	3860	cmd.exe	114
PID 3860 wrote to memory of 4768	3860	cmd.exe	115
PID 4768 wrote to memory of 5528	4768	cmd.exe	116
PID 3860 wrote to memory of 5588	3860	cmd.exe	117
PID 3860 wrote to memory of 6072	3860	cmd.exe	118
PID 6072 wrote to memory of 1724	6072	cmd.exe	119
PID 3860 wrote to memory of 5244	3860	cmd.exe	120
PID 3860 wrote to memory of 3164	3860	cmd.exe	121
PID 3164 wrote to memory of 2100	3164	cmd.exe	122
PID 3860 wrote to memory of 5152	3860	cmd.exe	123
PID 3860 wrote to memory of 4564	3860	cmd.exe	124
PID 3860 wrote to memory of 3940	3860	cmd.exe	125
PID 3860 wrote to memory of 3728	3860	cmd.exe	126
PID 3860 wrote to memory of 4496	3860	cmd.exe	127
PID 3860 wrote to memory of 2952	3860	cmd.exe	128
PID 3860 wrote to memory of 5372	3860	cmd.exe	242
PID 3860 wrote to memory of 4560	3860	cmd.exe	130
PID 3860 wrote to memory of 3988	3860	cmd.exe	131
PID 3860 wrote to memory of 2480	3860	cmd.exe	132
PID 3860 wrote to memory of 4980	3860	cmd.exe	133
PID 3860 wrote to memory of 5828	3860	cmd.exe	134
PID 3860 wrote to memory of 4884	3860	cmd.exe	135
PID 3860 wrote to memory of 3524	3860	cmd.exe	136
PID 3860 wrote to memory of 1988	3860	cmd.exe	137
PID 3860 wrote to memory of 3588	3860	cmd.exe	138
PID 3860 wrote to memory of 1572	3860	cmd.exe	139
PID 3860 wrote to memory of 4532	3860	cmd.exe	140
PID 3860 wrote to memory of 5524	3860	cmd.exe	141
PID 3860 wrote to memory of 3936	3860	cmd.exe	142
PID 3860 wrote to memory of 2348	3860	cmd.exe	143
PID 3860 wrote to memory of 3476	3860	cmd.exe	144
PID 3860 wrote to memory of 2812	3860	cmd.exe	145
PID 3860 wrote to memory of 4196	3860	cmd.exe	146
PID 3860 wrote to memory of 4972	3860	cmd.exe	147
PID 3860 wrote to memory of 4484	3860	cmd.exe	148
PID 3860 wrote to memory of 1140	3860	cmd.exe	149
PID 3860 wrote to memory of 5328	3860	cmd.exe	150
PID 3860 wrote to memory of 1416	3860	cmd.exe	151
PID 3860 wrote to memory of 2384	3860	cmd.exe	152
PID 3860 wrote to memory of 4388	3860	cmd.exe	153
PID 3860 wrote to memory of 2520	3860	cmd.exe	154
PID 3860 wrote to memory of 3756	3860	cmd.exe	155

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Fix.exe
"C:\Users\Admin\AppData\Local\Temp\Fix.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5128
    - - C:\Windows\system32\reg.exe
        
        reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:2472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" ver"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4992
  - - C:\Windows\system32\findstr.exe
      findstr /c:" 5."
      4⤵
      PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3472
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKU\S-1-5-19"
      4⤵
      PID:4588
  - - C:\Windows\system32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6020
  - - C:\Windows\system32\find.exe
      find /i "ComputerSystem"
      4⤵
      PID:4964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
        5⤵
        
        PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
        5⤵
        
        PID:5404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5928
    - - C:\Windows\system32\reg.exe
        
        reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
        5⤵
        
        PID:1212
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:5964
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:3416
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
      4⤵
      PID:4200
  - - C:\Windows\system32\find.exe
      find /i "0x0"
      4⤵
      PID:5424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5704
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40219.473
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2616
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:5528
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.61135.400
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40664.0
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 42.34433.0
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:3940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:4496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2952
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:5372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:3988
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
      4⤵
      Modifies registry key
      PID:2480
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      Modifies registry key
      PID:4980
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
      4⤵
      Modifies registry key
      PID:5828
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:4884
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
      4⤵
      Modifies registry key
      PID:3524
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
      4⤵
      PID:1988
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:3588
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      Modifies registry key
      PID:1572
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      Modifies registry key
      PID:4532
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
      4⤵
      Modifies registry key
      PID:5524
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
      4⤵
      PID:3936
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C2BB95AA-90F3-4891-81C1-A7E565BB836C} /v UninstallString
      4⤵
      Modifies registry key
      PID:2348
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{84E3E712-6343-484B-8B6C-9F145F019A70} /v UninstallString
      4⤵
      Modifies registry key
      PID:3476
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      Modifies registry key
      PID:2812
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4196
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4972
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4484
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1140
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5328
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 Redistributable" /s
      4⤵
      Modifies registry key
      PID:1416
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2384
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4388
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2520
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3756
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4528
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3248
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3252
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2364
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:5832
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4764
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1524
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
      4⤵
      PID:1472
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4176
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3996
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4704
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:6076
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2980
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
      4⤵
      PID:1068
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3300
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5888
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
      4⤵
      PID:3408
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4480
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5056
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:3396
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1008
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4960
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:2308
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5840
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2400
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:5980
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2536
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2908
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
      4⤵
      PID:4220
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1280
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2500
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
      4⤵
      PID:4812
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1924
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5836
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4856
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5460
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1752
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:5484
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4328
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5936
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
      4⤵
      PID:4448
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2380
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5772
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
      4⤵
      Modifies registry key
      PID:2804
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3392
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:628
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:3388
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4124
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4260
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4660
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2296
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5468
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
      4⤵
      Modifies registry key
      PID:5284
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3328
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:632
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
      4⤵
      Modifies registry key
      PID:2472
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4864
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4776
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
      4⤵
      PID:6092
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5368
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2764
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
      4⤵
      Modifies registry key
      PID:5316
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5984
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1376
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
      4⤵
      Modifies registry key
      PID:3900
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4804
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1212
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
      4⤵
      PID:4268
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3416
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2404
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
      4⤵
      PID:2960
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2024
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3004
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
      4⤵
      PID:5704
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:6128
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5188
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
      4⤵
      Modifies registry key
      PID:1344
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1564
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2084
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5664
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3564
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2408
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5636
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5532
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4456
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
      4⤵
      PID:1408
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
    - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{A4D85AF5-CE9F-4AB2-A60B-DFBABDF1B299} {3FFEC4FA-8C11-4779-995C-9D60A84484EE} 5372
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:3108
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
      4⤵
      PID:2980
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:1372
    - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{6885B2AE-3F8E-4C32-AED4-D62595E51453} {56AF9D46-0AC5-44E6-9AA7-2208C328434C} 1372
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4792
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
      4⤵
      Modifies registry key
      PID:5748
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
      4⤵
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:2484
    - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
        
        "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{EABEEBC1-13C7-4ABC-9521-89603FD90E49} {591640EC-F4CC-4EAB-A7E7-EE941248C363} 2484
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1192
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
      4⤵
      Modifies registry key
      PID:3940
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5864
    - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
        
        "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{BE439C9F-38E5-4CC4-BBF9-A7A8F89F7A5E} {885EA6A7-7F39-4564-A02E-C320CF06B7FD} 5864
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2952
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
      4⤵
      Modifies registry key
      PID:5020
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=584 -burn.filehandle.self=612 /uninstall /passive /norestart
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4812
      - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{81744EFB-4D26-47AD-B2BB-ED008588CA2A} {0D9EA547-EA62-4EA0-AF3D-31EB0972EC86} 4812
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5468
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
      4⤵
      Modifies registry key
      PID:772
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /uninstall /passive /norestart
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:5264
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B1B78646-0A69-4909-814D-BB0437EE809F} {7682FDC9-8235-4572-8613-B0E3983AE465} 5264
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5844
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
      4⤵
      Modifies registry key
      PID:5292
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
      4⤵
      PID:2084
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
      4⤵
      Modifies registry key
      PID:5664
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4588
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
      4⤵
      Modifies registry key
      PID:1940
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
      4⤵
      Modifies registry key
      PID:940
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1980
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
      4⤵
      Modifies registry key
      PID:708
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
      4⤵
      Modifies registry key
      PID:736
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6116
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
      4⤵
      Modifies registry key
      PID:4596
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
      4⤵
      Modifies registry key
      PID:2768
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
      4⤵
      PID:3704
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
      4⤵
      Modifies registry key
      PID:984
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
      4⤵
      Modifies registry key
      PID:4280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3920
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:4696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.60917.0
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1724
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
      4⤵
      PID:1564
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
      4⤵
      Modifies registry key
      PID:4820
  - - C:\Windows\system32\find.exe
      find /i "TRIN_TRIR_SETUP"
      4⤵
      PID:6108
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime Redistributable" /s
      4⤵
      Modifies registry key
      PID:5200
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3760
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:712
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:2084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.40219.473
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\Windows\system32\cscript.exe
        
        cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
        5⤵
        Executes a VBScript file via the Windows Script Host.
        
        PID:3484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo 0.61135.400
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      PID:4624
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:1276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      PID:2792
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.50727.6229"
      4⤵
      PID:440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:4592
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2492
  - - C:\Windows\system32\findstr.exe
      findstr /v /c:"0.30729.7523"
      4⤵
      PID:4220
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
      4⤵
      PID:3584
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
      4⤵
      PID:1456
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
      4⤵
      PID:5840
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:5600
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
      4⤵
      Modifies registry key
      PID:2144
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
      4⤵
      Modifies registry key
      PID:3524
  - - C:\Windows\system32\find.exe
      find /i "VC_RED_enu_"
      4⤵
      PID:912
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
      4⤵
      Modifies registry key
      PID:5560
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
      4⤵
      PID:5788
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
      4⤵
      Modifies registry key
      PID:480
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
      4⤵
      Modifies registry key
      PID:2660
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{382F1166-A409-4C5B-9B1E-85ED538B8291} /v UninstallString
      4⤵
      Modifies registry key
      PID:1120
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E1902FC6-C423-4719-AB8A-AC7B2694B367} /v UninstallString
      4⤵
      PID:5360
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
      4⤵
      Modifies registry key
      PID:1992
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:1124
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2648
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
      4⤵
      Modifies registry key
      PID:4584
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3148
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2696
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 Redistributable" /s
      4⤵
      Modifies registry key
      PID:5992
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3108
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3848
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:4560
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5952
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1988
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
      4⤵
      PID:4960
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4360
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5468
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
      4⤵
      PID:632
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4364
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5284
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
      4⤵
      PID:1112
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:940
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:3000
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:3080
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2504
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5020
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:5052
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:728
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4216
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
      4⤵
      PID:2260
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:2956
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:1528
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:2500
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5584
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:5960
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
      4⤵
      Modifies registry key
      PID:736
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5420
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2756
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
      4⤵
      PID:4468
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4304
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4940
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
      4⤵
      PID:2164
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:5836
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2784
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
      4⤵
      Modifies registry key
      PID:2768
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3188
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:984
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
      4⤵
      PID:3736
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:4696
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:2864
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
      4⤵
      PID:2024
  - - C:\Windows\system32\find.exe
      find /i "HKEY_LOCAL_MACHINE"
      4⤵
      PID:3312
  - - C:\Windows\system32\findstr.exe
      findstr /r "{.*-.*-.*-.*-.*}"
      4⤵
      PID:4668
  - - C:\Windows\system32\findstr.exe
      findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
      4⤵
      PID:5200
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
      4⤵
      PID:5664
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
      4⤵
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5376
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
      4⤵
      Modifies registry key
      PID:3588
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
      4⤵
      PID:1784
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{37B8F9C7-03FB-3253-8781-2517C99D7C00} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5716
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /f
      4⤵
      PID:2476
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
      4⤵
      PID:4584
  - - C:\Windows\system32\msiexec.exe
      MsiExec.exe /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /passive /norestart
      4⤵
      Enumerates connected drives
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2696
  - - C:\Windows\system32\reg.exe
      reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /f
      4⤵
      Modifies registry key
      PID:1240
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4296
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4236
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4696
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1144
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
      4⤵
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2792
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
      4⤵
      PID:2176
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
      4⤵
      PID:3368
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" /qb
      4⤵
      PID:4244
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" /qb
      4⤵
      PID:2696
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
      4⤵
      PID:5832
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
      4⤵
      PID:3864
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb
      4⤵
      PID:3836
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeMinimum_x86.msi" /qb
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeAdditional_x86.msi" /qb
      4⤵
      PID:5840
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
      4⤵
      PID:3148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:5916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1500
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding E8DABCD35DB03FABBD6BA7B408693F80
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:632
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2432F910C50E454F37B3C97DE8B40CCC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C04B3EA28E860B58956342D3A6BF2762
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3236
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 4C01832706AF944BAB0654FC99EFF1F0
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 899475AB4FC35D65EE82B594F85A4BE5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3844
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 65594D0A4C65574A79B2E1B0BBA6401E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3936
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9906B20DFAE251F5346BC45A46FD6E7A
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4448
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4950E2382C81EEA6AF68556E223DFB91
  2⤵
  PID:5748
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AEB5ADF11FCBE677E17774ACB2873315
  2⤵
  PID:2480
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A2C670089D1D85A1652553AA5F0251A5
  2⤵
  PID:4124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1F0639F1E271DF0F91F6E02043DA9FE8 M Global\MSI0000
  2⤵
  PID:336
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7D82FA85E593FAB22EDB2D6E29145996 E Global\MSI0000
  2⤵
  PID:3416
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DD617B51994195D51BFECF0C29B55B77 E Global\MSI0000
  2⤵
  PID:5320

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2456
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200036.log"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4000
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200036.log" -burn.unelevated BurnPipe.{88C19270-917C-49A8-8081-8AC99EB25DBC} {36294B73-097F-46B6-9F35-30F02FC00E63} 4000
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1956

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2924
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200039.log"
  2⤵
  - Adds Run key to start application
  PID:2384
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200039.log" -burn.unelevated BurnPipe.{1A2621B3-2D61-410E-A764-A9C702186CCF} {135A61F7-F954-4F11-A2A2-1DF8052658EB} 2384
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4592

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:6020
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200043.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5576
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=568 -burn.filehandle.self=588 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200043.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1108

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2728
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200045.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:884
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=584 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200045.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a0437.rbs

Path C:\Config.Msi\e5a0437.rbs
Size 22KB
SHA256 d6511f8b7bb6633135a3a4571f6a655b9a7c15e27666850213646a72de582585
MD5 ec31cc062ce22001a93caa47c14588b4
SHA1 296ec71c80f87fdfa133b82b1693e210b6700633
SHA512 f9f67e52bdeb1079bbe5f59158f23bbd2d54a1f947034adc2065fb2089b3dd2278e817900841bf9e2b7e941ab013c3d93d73c0e64aca450d84f8864b5b53432f
SSDEEP 384:PjRORR7NUZUGz5YkrcZqbogvXDWh4FA6hLGpCSK7:PtOmh
TLSH
T18AA2CB426640D5E3C86B2B30EDA31B693B32D7D59395878B00DD90748EA73C72F5DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0448.rbs

Path C:\Config.Msi\e5a0448.rbs
Size 15KB
SHA256 5fc904f27b579d3180f2020af70422834921f4c16d1993a827b4176c410331ee
MD5 762e70c8eec7bc555e93feb6df237426
SHA1 a2bdee50234f6e90dc7fc938e9722e9e188285c2
SHA512 578ff0a0ef48559a9019ff25fb024d824ed8cec374a2ccf0cf61080fc53154db1343f9778e742a9cac1602de2acb66031a1f58e7812beb5c21afd614b4795456
SSDEEP 384:CFERSfX27RRSmX2tR5JZpgBmQ7fpqPfdF3v:CS9N47
TLSH
T1D27230426A1582E2D8672B30CA0B1BA83F76C7D5D719834B05CD96308F577CA7EDC64E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0450.rbs

Path C:\Config.Msi\e5a0450.rbs
Size 20KB
SHA256 4076de839bebb5db32c8e0cca2b2cbd404fe2be0a2c0d045704e174d9b4e9b90
MD5 f268a5f7eb35822e05ad76b669c249c7
SHA1 28abe92e826f805676fd4e5884ba4a51f5dd855d
SHA512 d6c3cc68b15d568575854f65d7f482085fd8783621f3f5b37f08695d44ce5b9ac5144749137ac2ba3470c148ab52a94584194d61fc9da4ce345baa589df7cea9
SSDEEP 384:eORKglRGgFfXMawmn28I1S9HXVZFbLQPOCAOPaAf8cpOh8Plft:e+KgGifXMawmn28IA9HXVZFbkPOCA2ay
TLSH
T15EA2FE03B64495E3D8BA2B70ED670BA57B32CBE59361434B40DC95384F933C23E9968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0461.rbs

Path C:\Config.Msi\e5a0461.rbs
Size 17KB
SHA256 9a74004ef6c45338a4c4c4ab47f9d161a882683a49a3dd161384d5d0f93fd93b
MD5 9ebe4c4ef67dfe62fe2ab63879602384
SHA1 470bd4ce5f00f25e044eaadfdbd39a4c29dc67a9
SHA512 ecd4fd05df2be4c510d29a49111943054659c100fa551d09b603627e80609d2db716e67842d0656474c97bbaf047698aba59e49530208b3e561a39f841cbfe78
SSDEEP 96:eeRp55Rp/NQWT8RNeDd11xQo8R4eDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3TjH:eDRQ1GRn1Hn4Xyin5f7e+nh18X0Zy
TLSH
T1AE82FD42AA4096D3E8662B70DD571B7037B6C7E5E344839B40DC92349F87BD22F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0468.rbs

Path C:\Config.Msi\e5a0468.rbs
Size 21KB
SHA256 6467974e1f27a3c7889c151c3f938eb40462c06494f1081a00c8c27ed49782ae
MD5 a71527a0988d7a22571fa1ba9ce05630
SHA1 b189f373d988b937733aeba667f8ebc0219d8da9
SHA512 fbf3d029caf9a06ccf8c063a95ead4e4ec65b60ef69b65e3373c2846914f52a5cd870139d7a6a37d0f4dced91676b2a768c5f6a140307df2aaed73bd91a53bb0
SSDEEP 384:k3RsGRAnAKxNAUhUC7xJjrMNYPzIbSfZs0DiCdaDcVXkP:kh9wAKhkmo
TLSH
T1CAA20E03768099E3C86227B1DD671BA93B73D7D99350434B10ECD1388F633C76E5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0479.rbs

Path C:\Config.Msi\e5a0479.rbs
Size 21KB
SHA256 dd9c48c80b6fd3e80083cd138ddebcbcfdd32022a8144f09cf445eace4ca33e6
MD5 fb2f25ae90f4668508d0c40ba9c1459b
SHA1 aa7eb8e5141d1090c2a3fd05ee16a3c4cbcb0c01
SHA512 84779b2f39ed854413e96f7be84081ba4bf7c5b9c1dda62d991a94d4af8c3f223a685c2debe51d38f3bc471a1c00ad58c3508fbace53a5d932d786d837998f6e
SSDEEP 384:AfRSWRhUe5esSOMX3Mq8KywUiH4HVV6IhrAZIYpB:A5Lme5erOMX3Mq8KtHH4HVV6IhrAZIYT
TLSH
T131A2EE03B64096E3D8672B30DD6B0B257B76C7E99351838B04EC91344F977C62F9A58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a048a.rbs

Path C:\Config.Msi\e5a048a.rbs
Size 20KB
SHA256 bb412ca8cad369cf300e6e402ecde6e95097b8aa8b3b3dbd83a6cf71f7925766
MD5 4ef0143cfe47751097868f759150b682
SHA1 4ff27b83749a15f6fe36d11a229e5b539bccb5da
SHA512 121b3d0319584197db8a26a7cbb5907b47f3c46060802fb20ea8a05e0dd2d8f4fc3047f2a6053ebedfd7959d28165a9c5d04f496a3720d903e511641c0bcd9bc
SSDEEP 192:zuRU1kRx15dXcFUADIc1f+W+y4+oAkgCj37:zuRU6RxTeC81f/cqE37
TLSH
T11492FA42BA84C9E2D8766B30CD631B653B76DBD5A350438B40DC94308F93BCA2F9C69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0498.rbs

Path C:\Config.Msi\e5a0498.rbs
Size 13KB
SHA256 748dee6ec013bf9d28edfcf9d5305cfd3f103fc3b2ae09f8a1e29d3859cdd635
MD5 a79e473acd5cc1763fcea7413e806706
SHA1 77f6c502420fd47b4da673a851c86da67c654d55
SHA512 c6fc27a8a86b4f483c4b3ad094af6a3959bd041d29601366712efd4ded3fa726a4ee9f564762c73deffe7cf250168eef602a192accc4ec62726ec54c9f325022
SSDEEP 96:AMNp48xNpM0I7ztH8R5eDwYx12tH8RqeDwYCj71rR7c7QNpx1FNpLxcNpkFaxcTY:AURdYbR6YYaqbzfCgPo6/cfl
TLSH
T1CE52F0036B0586C7DDA62B30DA230B243B73C7EE9354835B21DDE1748E577862E9D58E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a049d.rbs

Path C:\Config.Msi\e5a049d.rbs
Size 31KB
SHA256 ba846fe861c20594037fc0becea394be1f7849869a3db5d1f0d13c0e2bec0894
MD5 b9f14395f96da156d125a05412dbe88f
SHA1 c02b2a05b8be033c2ba2765d7212ebe3048426bd
SHA512 c30e0491c875638a8a532b2032cb9ac629640ab637eca00f1211e6cd5d456f80c592297b98b2e2ffe3b046e12485044bc4838b51181da610948b2e9c872c6c67
SSDEEP 384:5W8N8hRbeR1Tu8iu8Uu8XcAlRTMV/ZawBV3yFgmktRu+Ru2S:5KaNsKVvRIVxDe6tRu+RuJ
TLSH
T1F6E25502F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04a5.rbs

Path C:\Config.Msi\e5a04a5.rbs
Size 31KB
SHA256 48694bec5a500547212d10e96cc9ec8349336c4f81777d9069c3a6ae962a6379
MD5 d6286f818bbb6425659b53283cfc57b4
SHA1 b4ec94eba1013b40a1056f21b27fd4da5e8755e8
SHA512 23590eabae694261d3ab73e034ddb06e842b3ae89d92fafbd13029eb6c6b078412f2d133b1fbf7ce5e3f926b53d6f379674e5a04ba7d501f3ae4ef80beed6795
SSDEEP 768:XiPnUZEYuxy1SQBiYsAE6HRzY1WY3BYBYFY7YYYpYclxlQrnr:71+4
TLSH
T18BE27307F316E6D2E9493F74C5032B6CBB97D795830E064F44DDC8A00E66BC66A6538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04b7.rbs

Path C:\Config.Msi\e5a04b7.rbs
Size 4KB
SHA256 a48ac766cddbfc736bbe6b38b722663eb523cfde9b50e34662ab85e22d05b00d
MD5 f698b2bf7e00bc0f50f0dfcd7a0c2e11
SHA1 7c92d37eb587ed5e98f0fe735e7db58431ac28ca
SHA512 70fceb04d0da6fd05097848b794b24ecfa1e18d4c28730ce9c99b3edef7ce9bab71e19ed1b4dea387b8144074152ce4eef99a87fd1004a399e152a2df33338e2
SSDEEP 96:smKWQYWIHCxStTJ87S/WcWVTJ8/WcWQe36aGmV6m7AwQQm0QN:plUYCcYD1nDQQ9xMb
TLSH
T1DEA1A8039604D2C3ECA25B70DD17171873B7C6EAC721439754CCA5B44E8BBC5AFE9A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04ba.rbs

Path C:\Config.Msi\e5a04ba.rbs
Size 3KB
SHA256 5894dce68a5c7af4d0c2ccedb3ebcceff33e28a555258ece67a01b44dc28db69
MD5 98f315c1012dd2f8b66eae626fd6035e
SHA1 bcaa43a8b946c3cb4360999f434041f7125ff2d4
SHA512 f791404a72a77cbc94afde59d08cbef5776ec16300d836f471497ad5f8051e6f090bd866390c06e50c3b315e703cfcbb19edb189862bf8c7e887c43cf7b3f893
TLSH
T11471C142DA44C2D6ECA96B30CD471B2037B3D3DAC364838715CC91708E47BD6AFEA58A
MD5 SHA1 SHA512 TLSH

Submit Download

e5a04bd.rbs

Path C:\Config.Msi\e5a04bd.rbs
Size 3KB
SHA256 7bedc1d51f45ddabf45ecdbe8949c65f6c052a07464a39a031b707429bd46332
MD5 77d5f19aaf04abf6153759ae1a9467e0
SHA1 6f35cbaba61a4aef1f62bd909576ce38e7f740c0
SHA512 e20cd8e1b9dcc3032070a7dc628f02593f3503e406015574bd042a3952985583ac8833eb27a2a74d7c772a379456231ef09ae8070a7cc50ad2ba70677092893c
TLSH
T1D671AB03954893D6DCE6BB30CA571B143777D7EAD7648387048C92700E477DAAFEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e5a04c1.rbs

Path C:\Config.Msi\e5a04c1.rbs
Size 14KB
SHA256 132df23e4bf015c9bf11e0375fc4c00a5353e51184c6035dfb466035143c5b10
MD5 5bba418fe605cc0dda679d2a28ac350a
SHA1 1d693ddf6204439a383d04dc00bbeda3919a799d
SHA512 215c43d1535d51f9c95f1be7e7e5d9df55b529379731743d7868bf92a0484a968ecbf0c9483f447bf4a25b166595ce714ccc56acc2ea7de384a5ca07e78c7415
SSDEEP 192:5yJXuj2IYcw/0FBC31QAkI4QAkJnFEXENNep6F:5ytuj2IYcw9hohOh
TLSH
T17162E042A60082D3E8AB6B74DE5727183BB5D3DBD391638B08CD91304F837C95F9969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04c6.rbs

Path C:\Config.Msi\e5a04c6.rbs
Size 21KB
SHA256 6e00fed3830c5aa3087887def5545b71304e39b133bbcb07b4417bc29efdf85c
MD5 18e1685757d005f25482c435f772baba
SHA1 5848fe53f8ebb3c798e6ae27373f63d4f36eae99
SHA512 2970683dc7f1c4ab6b4b72e0bc59ed38adc763ed46395be54eb22307b2f1699ec20325ff89d08b4a26e6a379231f5ff7b845229626308ab5231a32a1844b4580
SSDEEP 384:8MT8MgXEtmrnb0MM0IE+AfCuS588UkR4z4zB5XDcpq:8MT8MgXEtmrnb0MM0Im8rF
TLSH
T17BA2EE42A640D6C3D8A76B30DE5B1B653735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04cb.rbs

Path C:\Config.Msi\e5a04cb.rbs
Size 18KB
SHA256 888d4d9cd4bf426f4f6f98ac8f9f697a7fe717153764129b78fa3dbbd79b1be1
MD5 8455af15aec33b3b3711f0ec45188097
SHA1 2d251b67b373cca815c1565e18fcb48c81b520bc
SHA512 824c0e5c4eee36c2825850c98d7b874c5bbc46b755abe258b5f4690df1e92c62f9c5c9a358720c7036df607762fa3de33e80821c0d855bcd8d38f5debedd65c9
SSDEEP 384:81Bpt1tdtgt+tQtHtMtOt0tftetltGt6tMMNiomFhr/EFhr7WL:8nXfGY2N6oCF4HgMq0w
TLSH
T18392DE01A600DAD2E86B2B70DD5757A43B75E3EA97A1934B01CCC1708F973CA5F8D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04d0.rbs

Path C:\Config.Msi\e5a04d0.rbs
Size 21KB
SHA256 b3b417955b34ceeaa511035c6ac44aea79e26f02476e131cbad49615767a6ae6
MD5 33ea67ffa69a4362dda14636fec687aa
SHA1 4cd7920890d98eee99ac1c6aeec276a29ebc45e2
SHA512 024eb01a05b1f1d977c709446ccec29e498f27617023aee3544c0123630fdadc8cf076ae1e7394bb68b2d4d6c98c80cd14368fed55f98db21ee94feb716d9671
SSDEEP 384:rBPEsZBwNx7pxqUjy4O3JqsalckU72eC6T7vxVlDXDINUJYJB8:rBPEsZBwNx7pxqU2v3J37JVljENUJ4B8
TLSH
T1ADA20D02BA00D6A3D86A2B70CDA72B183375D7E9A752534B00DCD5308F977C6AF9D58B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04de.rbs

Path C:\Config.Msi\e5a04de.rbs
Size 4KB
SHA256 76151815e6caff1cd4da9bfd424253664dbfb9529ed47ff8df2aa2223de6564d
MD5 d510279a5aaa4db9aa85b80655567dca
SHA1 ee6d5a191745502e20d0ffd605af35f2f541a5b9
SHA512 9acaa18c4d6f840ba03be8a97f3dcdc9de002a77c64c32c8fb8cb190039009da3449605a5d4885f0b896f555db02583cf4b42e30c37bd2ed9ac0e3c402e4bcf3
SSDEEP 96:wsKrwKIHCx36tTFq2236/KcKVTFq22KcKQv+lw+C3+bv3+70rwQ7+0Qx:wrLYCtKyPb1RbQvYw9oP7HU
TLSH
T1E0A14A029604D3D3EDA61F30CD17076537BBC6E98316839B04CD91B44F4BBC9AEEA65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04e1.rbs

Path C:\Config.Msi\e5a04e1.rbs
Size 3KB
SHA256 aaa6cfc83d184722f4cc30a4cbd81d75a19c7bfe3865a4d9eaee7339314e8041
MD5 19a17e9922ff5bdfbb1db7aca3afb696
SHA1 3c5411b558105734661f0b3695cd0358fa9962bf
SHA512 7e56603dc1fbbf6c76ea12c8b0d8abce8552052e0eedfd496d839db1adc951c39fe67f9da92a5b1f5311bdc54dce0801f4fd5aea8d528b8c9a15f2b1065e4342
TLSH
T14471AA039904D2C2EDE63B70D9571B1537B3C7EA8750934B11CC91704E47BC6AEDA24A
MD5 SHA1 SHA512 TLSH

Submit Download

e5a04e4.rbs

Path C:\Config.Msi\e5a04e4.rbs
Size 3KB
SHA256 762cd002e9db33fd1099c8588b52b11249b02479a7bfcfeb25f0abc2917becee
MD5 b9d1393c819fbc6439b9ff3501a14e82
SHA1 3f18d64da4c64af2567b9853e15a9bd882601099
SHA512 5edfd5ec77a00e895c3358fb24ec9c7aa21ed06d0438fec0853888b3e747e32b470604f0b9622e72ff6c6a82d031f2f46cfaf22aac95b169c3688252d09f4a12
TLSH
T1FB71C043994492D2DCA62B70CA270B6837B7DBDE9750438B458CC1740E877C5AEDB28B
MD5 SHA1 SHA512 TLSH

Submit Download

e5a04e8.rbs

Path C:\Config.Msi\e5a04e8.rbs
Size 15KB
SHA256 57c34e1c15a0f4026b886a6549e65fdc6cb627d8dc77bcea693de5450c7c57c7
MD5 f21d84ce534304f6ea8cd2b5e5a1d0c3
SHA1 5011264052e46ceeb25c0f29c9fdde492fff432b
SHA512 24a6d05c389c8827cf0a08725ab27e50ff3a33da2a88793c0112e9bd3c3df699d7c40a75706f0d92ca7fb802205f310f669c50c34ce1074016e71594e56d3fa4
SSDEEP 96:YrXNpU0jNpgbKwNNNNXsrV9NpvHP+HRxWR5OeeNpVZC/zelzeQKwSUZMeD2gARCY:YrSKrlR5UCA1zAkIgzAkyH/EnwNWepFh
TLSH
T1B4621E02A60099D3ECA62B34CA971B593732D3EAD354934B04ECD5749E87BC61F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04f0.rbs

Path C:\Config.Msi\e5a04f0.rbs
Size 20KB
SHA256 eec3f32a7419003e060cbb61a2db084f31844162adf019562848c56389e5cc69
MD5 1f1d6fab908849f3452c3a7841f57c0a
SHA1 fe28ca24635e235093ff2b50a7465740164789f9
SHA512 194df5d2ee4c10e4fb31111705aa4f6207a1652e751517d4acdeaeffe4325c6480bb2e08b54e8456bac3d0c1fb5504af237368705b818dcb8bdd8cf232010114
SSDEEP 192:qYUU92K2jY0E1iKCq3wzR5KCf1vAkIuvAk60W41E5kCT4b6epRX:qYdIK2jY0E1iKCq3w/7I+ISYT4bZ
TLSH
T14892EC427A00C683E8A76B70CD6B27283772D7EAD751578B01CDD0304E937C66F9A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a04f5.rbs

Path C:\Config.Msi\e5a04f5.rbs
Size 19KB
SHA256 51dc6c11434361a8f6c1fb0dfb398059a3d89f03de41c0422839baa3d69f2063
MD5 8fd88311e70a4d4a3753de99b813fd75
SHA1 c73cf41b518f8e6a5eda7fda3d9ceaaa5d7364b8
SHA512 c2fcf1ef585ccd5254ca6c94f5072fc895ce032b90208edfc518b62747745e95ba2833319f44cc8dcde62dbfb25f95a408cd35c74a2ebdaf428f693ec392df9c
SSDEEP 192:z2wdfHzRACgehAZIyAZw9YjnFEXHDU5p5:zHdfHiiArAxOq
TLSH
T1F592DC027A84C5A3E8A62B34CD571B153772C7EAD350D38B05DC91309FA7BCA2E9964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5a0500.rbs

Path C:\Config.Msi\e5a0500.rbs
Size 20KB
SHA256 02dca8eec2886c7253e3bd7fbe0f8eed131c1483e5c63d4ca33175794f2e9111
MD5 7fac94c884e130c96749ae1b64dd0e0f
SHA1 c36caee0f5be5aefc0aae6cc6af13018ca591a89
SHA512 63a3f57ad6c2ee454cb00435f169fdab1fba6de048d98d689a5b60dfc140f581b12e289a38e337a9a4833cbec41dfc887a1477b756b11f6b26e94408149659eb
SSDEEP 192:srSAh7C4tk0Ve2SD4QsUh+vzRqC4htZIAtZ5Es/GWfLsyEhx5SR15psF:srSW3k0Ve2SD4QsUh+v4tRtA2nQ7SR2
TLSH
T12692CD427A00D592D86B1B71CC9B57693776D7EAE751830B01DCC1308EC33DA1F9AA8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\state.rsm
Size 592B
SHA256 c462e28640b5187119b9fc7c88401c427399dd9b37a91f15e1c8f088a2228c00
MD5 a8ef5498f6e840f265c12abb3bf2df46
SHA1 6dd9df693d5b830ab42a06c6cb83291bc4dd7fbc
SHA512 b1bb657ed8f944c9bfa6509dcc0c78265329bdfe2a7a35cc94463ffa70926491a7c955397502f4df2eb466e52f2bbdba6776dc070a381299ca92b77236907b34
TLSH
T167F0E6654FF2501DE2B3A67178F50656595BB4035931C42D0182318BDF317C1DD64B56
MD5 SHA1 SHA512 TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
Size 232KB
SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
MD5 824f1f188704d3de77660d90fea6b136
SHA1 9bcad1428defece9f2ceaf647d9571ca41b3f40e
SHA512 0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972
SSDEEP 3072:55Sa1UNmUq59Zh3pe8lwAx9JHHpXhvq5J38J:55Sa2qr/HHpxva
TLSH
T1E7344C11B552C133D8853332406FDFA12AAC6EE79B52C58721E932DC6EB17D4D3792CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 26KB
SHA256 b16307c2746197237e85557496dc66ba3f0d20b0ad24905040c13af5cbb01b22
MD5 553e978f02fc632c3ddbefec6ae483fe
SHA1 52d912a17fe4beeadc52fd96ea72c45b14313509
SHA512 8f03c426dccec38279e9e6ba515242a4b89e21bdce8f06ae0e43f97fdf82bd9bd1cc417155e1ca18ec142a7af845ae7991b8a4e4bbf646683b165fb64ebed78d
SSDEEP 768:WaSz7GzGs+PFJE7ywKPun3RAL9iAbO0igwJz3/o9L/Y7xoXyEMdBE2SEAgEEc1PL:EL9ix0igwJz3/o9L/Y7xoXyEMdBE2SEu
TLSH
T109C291187D4C52367AF0C3B6E3359182FB6ED5A25B30E68C7CE6C8A0746B156903E3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
Size 971KB
SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
MD5 1eb17f650462eea820f4cd727d2d3ab1
SHA1 688f59160589ffa293502bffcd5c0e62e1993903
SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
TLSH
T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
Size 900KB
SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
MD5 3df1d7da8c1493a5a00c0474323fef20
SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
TLSH
T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
Size 101KB
SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
MD5 ce18bc86e63f3192719ce0d7f286a130
SHA1 86a935fbd2fd9f5b39307ef986146cb2ff2adc33
SHA512 236bf295e0551ba64d743833ffc5c1d1b5b4915c9df5ccf3300013c765befb37808651087c388962e2f7bda0a143a406f923f408a24373cee9e6cda49aae5b73
SSDEEP 1536:7Jr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016kyBekazo:7Ji6vPUL7zxwXmh8Gf99XZ7Bwk
TLSH
T125A3F81483FC4F61E6F71B742DF6A0814A72FA625EA2DB1F102D410D1C63B949A62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Size 27KB
SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
MD5 d0958d7bb727740c9d9952b1805163fd
SHA1 a3b18971219311fd6a7e5f2be14979c3777d4d68
SHA512 138bd86e0b1f0b32ba453475e1fa81e11e9d4300db197b58301a5d478b3213079dc30c700f52220ff957fef10c4c85d1230308d83cf7560547b475fb346e1460
SSDEEP 384:Sp0wdaXOa1FnKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81dWIY83gWQsLBiHR1:O0Ka+q+6rqnDPOyBeRmoQ9zpI
TLSH
T139D25628D3F85312E2B38BB099F5C447AD76B953AE34C7AC2596534D0C227849963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Size 31KB
SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
MD5 55c9882d7612e7e8b69fa5920410be3d
SHA1 9517d22cc6d9c7f9b64d2c8152849a9075027c91
SHA512 a6fc94a8a0d6a690493819efd463b5263871346a94e7a1caa379871dd1fdc6527311b02eec70c5b49406aec53bf4e2d04d14c592754bdd3f6a251e64f9e2b024
SSDEEP 384:F52RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYWcsLBiM:3urKjgEnGEFiJrvPAOyBeF29zKk
TLSH
T1A8E2962893F81312F2F35B70ADF5C483A937BA03AE35D76D2586174D08667849963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Size 137KB
SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
MD5 b5c91699e57a807b2143cced62e70e77
SHA1 067f80a3c6b16ff9c4acff06099393084b6368ff
SHA512 d843235998b04d8f857239b31b5866c5328de3455b330f57be5f61acccdaadfa174231cbc57eb07f8cc5f7f3d8ba598fa0399fd8d13759d3c428d31a07265003
SSDEEP 3072:nEmV8EKUaX1IrJeE+6pwluGCulHxTqo+UeYBs+:nEm5azUaxWIN
TLSH
T120D33B11B7FC371AF2FB0B79A9F96001C97ABC556A26D78D1851424E04B6FC08A32B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Size 79KB
SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
MD5 2c100809815e27163493ea5e81010d1c
SHA1 01ee717e6f9d6c3d574ffe82c1cff3cf2467419a
SHA512 c22de3606e5cd1a9ac2e1cbca3c156831d5cbb99a50e4ae9f34df7d93b4d9093447d62b3fdc031be84a6c7adf16e23f7b5b44ba4eddf21bca13a26704d8a6b63
SSDEEP 1536:QdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHp2gXmyBejjzQka:yYR63P8dlNGu1IcT7TXLqngXNBCjkka
TLSH
T1F983391193B88327C6FE43B464F0A8125FB9F253BEA6E71D09C5A39A48537C18D5272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Size 85KB
SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
MD5 33247411fefa060b5f86eecd66b95078
SHA1 74784f9e3da6f1579a22f5723d46c5de50add359
SHA512 c1ad16c956cde61fee693b1483905ab6711841750bab35848a1e7261165f37273d8380daf8e6f4d2d35d520ec52fa943938f3ae7ea056a112bc9200d7e49c136
SSDEEP 1536:kkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79sShdX+yBeS2TzR:kk3gCbzexZG0YUBXfqidDhdX1B+Tl
TLSH
T18D835B27A3E85713D7F74630A8F09A03AA71FAC37565D39F2046672908AB3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Size 44KB
SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
MD5 c2e0ecbe64eb072ed008257142315526
SHA1 3d732f858fe67bae8f369ef19ef282e11a83f656
SHA512 5e0d2a7484e63254e455d6e9da44f79533638607e41d7c4eaf77529f6dee50904a675d8695a8e5c0ac835e813f2a7e11e7b1e0cfdb82553edf653451fe816203
SSDEEP 768:Tc1JB9Xaefxf2ZquXoQGaVP6rqnig3MbvyBeHO7Ex9zQB:A1JHXtp+ZquHVVigczyBeHljzQB
TLSH
T17013D72493F80313E6F757B099F1E443AA777953AE29DB9D1099574D0812BC1CA22F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIa3db6.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSIa3db6.LOG
Size 2KB
SHA256 2caa91dda048a3a318c4de8fae4ae551af31c8edc566c6133b778d6b34409c1f
MD5 5fdc1f21162ee8598f3c37717f74cb5f
SHA1 cd2c87a05f3dd8a9cd704659496b84dfb9021478
SHA512 ef98ebfd09dbac52d435e2c3e7e24ae33bb65cc8a2dbf8302383a0b5e69e4d6f13e84e8b0485a2356fbf282129175bbbefafb5b1b2bb9349569ae22a5555192f
TLSH
T186414C286FE50844B1768747DDF780634A73FCE45835C60D2385831E066BD09EC2D3AB
MD5 SHA1 SHA512 TLSH

Submit Download

MSIa4111.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSIa4111.LOG
Size 3KB
SHA256 674fce3348985e7ea3094f0e6fbdc96e9d171ef4b0dbe4c38f744210ddd5161e
MD5 4efb674bebfd3880baee01d22bfdffc1
SHA1 0ddf63e180e3df60d5f1213626bf46046e437cdb
SHA512 d51565d1b341d8e4aac3ff6d1d71d3300b5a4357f999fbebd0aaa7a1978adaa183a11a56931ca631cc227ad784e654abaa95054ade8209b8ceadbd3561955c44
TLSH
T1D461D6241EE90C95B1765647AEF3C0139A33FDD26835CB0D2386831A46AFD08D8693BB
MD5 SHA1 SHA512 TLSH

Submit Download

VisualCppRedist_AIO_x86_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
Size 27.7MB
SHA256 de0f71175828f9214494a6f6612bb653d0c023875b8b544556bff84ee4953d96
MD5 91e79e0543a28b0003ba1801a5132830
SHA1 00caec42c200e33c87a15b9ae105a977b3a1edde
SHA512 786775f33a1b2efc06604248261503012ae457a8805f2c1d6fdfc3f189257db116acf13b2420963c68951718af1b957cd8a1a612ba5fc7ac9bb6ddafb1831c4f
SSDEEP 393216:rV8PuFzZgmwO6R2AIEd3A3Pr9J6SrAYVLMnbu7vB5uBlwBR3i4VZssb3piHVm7/N:x6u6IA/dwjqYVLvuBmBRS7e3MgTN
TLSH
T1BE57331231ADFCD2E43521313B33E7D5FB7DED4AA1A4C98A29D01A05627E6273AE13D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260908200039.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200039.log
Size 7KB
SHA256 a53baf350519b2dc1780d8ddf87fb5317cd40388eb3c4dc7d71222a44ec73fff
MD5 88359caef75bb29b96016bf72c55996f
SHA1 bd27a8419b0f5e27a7d823399a70805033f81a73
SHA512 ca0db4ed96784b0571660dc3860b89770b5407d26f508b947733582cd79212c00b121b8ee31ebca8eca989c1b798fcc60a55198446a1715c1b5f18c640bc757e
SSDEEP 96:ECAbRjTbKbQbxbcrQr1ivLrvccN8/U9Wbfb/b+D0zkYbKb/CcbtQQ:iJqwdEwQcbNTzDkYqzt3
TLSH
T1A6E155016BEDE3A92DF0E19EC4AC1FD95B363905258097F077B54758C206A3CCFB9262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260908200039_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200039_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 9223b4f6fe97a6ce71a64ea8fec20ce104b86b8ea9d8291fe2d70b890aa2a776
MD5 dc81d459efe995673f6de398feaff7b3
SHA1 3f422c23e9b0f0762d3af68c793ef459fddfa1bb
SHA512 c5cf6b689d305ec05985b368a890ed24e71f968874dea66706df2bb0226963676e29418a3a23f4c1350406a697328e70a071ec3897de0dc8cd05455074730d72
TLSH
T18F41C4691BF90887F1B257479EF3C0931B33FDD268348B0CA385831A4A6BD05AC597B6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260908200039_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200039_001_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 0b83588f64fb9d2dca170112955abd301355783eec482f65d5f6b20a9ddbfb53
MD5 265818ffb667ac4eb1b9d375a1616b2b
SHA1 0e44231743081ca623a57e5b5e0570037aa2b170
SHA512 c23400265300d701f7960399fcec01e2403bf295e87cf7334f6523993d5e3e092d31bde9becd4ccb97b24241c9008ffb9c2b4edb87001f013bb462a59a6084bb
TLSH
T1CD4105681AE90845F1B697579EF3C0635E33FCE268348B0C23C88329476BD06AD587B7
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260908200045.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200045.log
Size 14KB
SHA256 0453466b05eea42c3263e1f7dd0f1e70ce29a60eda5dfe078709765a21dd6e37
MD5 b0bde6f8d6dfaa9049324cecd3549331
SHA1 740080a443ca60a83a7211c09a74f923cec4bf44
SHA512 c6e1439a9f0fdf3ba9ebe809b1a251063bee0bfae27027fddad2872922c662a5f4e1a3e4484c73508c3479813683cfb90dfd1e9041a1e7559f935adaaaf1f9f3
SSDEEP 192:r7gnq1S1o131P1U1a1B1lUMdme7yQksQQWLm+5tL3n:r8qUMdENQWLn593n
TLSH
T14862241237FDA11134D0ADAAE0951B7693A6771A26C04274BF2E037C9208CBDDF79D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260908200045_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200045_000_vcRuntimeAdditional_x64.log
Size 3KB
SHA256 6b29943d19366a4b0694bbf1b3de90ac56ae3793d22abe5b22a729744e6c81da
MD5 26c69fbe3cae689df0968b2d1a8c1736
SHA1 ebec76a43734eef4aeda57ed6b2428dcb4590101
SHA512 3dee02331302d920bac406dcda7810c9e9a5d143107acf49632975791d70e7ade99c2174a7a642d6ea4a4bae1cdfa9f4524a6160ae8ba5db857063a4cc59a6c1
TLSH
T1C051A4651EE90C85B1B666076FF3C0537B73FDC278358B0D238983194AABC04996D7AB
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260908200045_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908200045_001_vcRuntimeMinimum_x64.log
Size 3KB
SHA256 b056ff29265bd1f1f22ad6351c57ac2df27cc9e3437cacce2645c3f4575eefeb
MD5 3f462beedd2388d599997003c95d245e
SHA1 8b1b6704daf10d016356b1a4f113010e31eb928a
SHA512 2cd3ffee85b1a9b8a2b80aac480d4815039f4395b5a68db3b4757fde096103d794fd789c07df562eebc8ca7f17f10ca74fd47b5dbf6ca2f08c52687c60aba5d6
TLSH
T1DE51E9251EF94D86F5B25607AFF3C1536B33FDC179348B0C238983194AABC09D8697A6
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260908200036.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200036.log
Size 7KB
SHA256 0b2a8ecbf80774b08b630420f558832907fadab6077c8b020532496a7067d39d
MD5 f6514ae8da2c944d68e008fa6287aaf3
SHA1 6f040fff6f9facd2841e296c6c352e9a78fd1d79
SHA512 7962ce601717f0ee38bc87efa4de75216484e243e1510956c372011a68e74e2fdbe4d58ed4cd6faeaa2d783c14a2ee02c00c92958a9d4b01268eaf587967ab4f
SSDEEP 96:JCcbtblb/bSbnIFGKcqTaNiaiBhbxKbcbbkMD4zIWbF7bNQCSbHC:NBZzynI+W/TxqcXkZIOF3NsHC
TLSH
T143E1221035FC719438D4E29ED4D856DE6739370A2AC0F760BB66532A808AC7CDFB951B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260908200036_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200036_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 1de2efdeaa6e460b71905972c8dbf69a71064a74e0e8d6f58fc7c60c2e3216e4
MD5 0bf398e4dec740b3e9e331d5f40f4712
SHA1 8c6490205276322d52cfc3e15ebdceb6d7b72b1a
SHA512 a09076359b5004852c0da45ce525f5813bc38b20fbd95bc41daf673d989aac80d2e07b62f54265beaa9710cbfbd645adf1d161f569d76caf52c592d9dd800cb0
TLSH
T1F441F7651AF40845B1B796079AF3C4234E33FCC169348B1D2384831A467BD045CAA3AB
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260908200043.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200043.log
Size 14KB
SHA256 1fc1b0af4578fb201bbcebcb02786f9de22a698346ab20da80db6a13bd4df72a
MD5 4c1662bf126658f7641e66b700ae1f95
SHA1 9b80e78f8fa13a38bacdb3350060e72ce6ee189b
SHA512 6d832f2b1112ec8a55f9b1fb14523b1dbb906b274708901e887077a7b5bdc21c72998590194484f59a2bb6469416e70f0ed2f5409afeb90ff1d45b0affdc2da0
SSDEEP 384:detFETXGG6SK5CF3unCyO3/i+ya8T0oqbdao1tO6rr:UWF3uCoqt1Lr
TLSH
T150624342B3FE65193990E3A4D0590B96532E760D356043FCF7B5026C928A87EDFB90EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260908200043_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200043_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 e499e12c2ff514c60f6c42f85d60ee548987f7d17a4ec449460eca092e026eeb
MD5 09312b1678873627a98af8d4e7a83fdb
SHA1 fb7af4f0fa479569f5d21b6b2849600e67004767
SHA512 1fcab36f30bb772658f7dae745f15f85d83d86d7722913c1978961c8c3c3b9eb2a254e1237e6ca792b3df000a1be3811376630baf22646fe988ff9617333cddc
TLSH
T14D41F7B91BE00949B1B266879DF3C0524A33FDD668358F0C23C5831A066BD04AD987AB
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260908200043_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260908200043_001_vcRuntimeMinimum_x86.log
Size 3KB
SHA256 4cf6259d2068e5c0c399d1b37b087de508256ececb78878eaf4482bc3319a8da
MD5 da6a67019e3e633412af83613be4825d
SHA1 aea8d1f73031acf3ee65b3ecb3d42d12b8ab09c5
SHA512 88336066c4c5f0ebb519de997c2f752b9b27dc5fa8369590f52024f49e10904a1f84c4ea77d81d3a4ad7b72a950caa783c9ef40ff092e3b2993e430b8191fcd1
TLSH
T14C5109651EF80C86F1B266479EF3C4535A33FDD16934CB0C2389831A4AABC05986D7AB
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 333B
SHA256 59327fb0659e9488cb520d2fdd24d7000d36a773a876d554e65a3ac05a758679
MD5 b7c988cd214e6f867701a56fa206a3fd
SHA1 885555b9dc19fb747f4b6ebe674ff3aa1807085b
SHA512 6e616a4085c8cad620c5d8729ea676fab3e8278c03f69ad831f03f338185e99a2e07cae1ef1313d55a8f0a1c0cc4a0c4ed1090eea687d4c9f737e658fb700c6a
TLSH
T17CE0865246304015EBF571000B4F4D182FB9976B22D7DB0566CDE581223BDCBC5AE1EF
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 861B
SHA256 399db8146e8442dc50c9391d05a2ce8a0cabd10cff836d71613d6a6b222c0324
MD5 ce0283e557416bf677754ea124557b53
SHA1 eef0d2bfd291c5902673c787cb43ff57450ee3b8
SHA512 a3bdb3cce09f538ba90e808b4bfac777c92cd1a8897b4dc96ad054abbe5ba12cdcac653270a4a476eb02964724f5f53495a08f4a8cb83bae4e7f4c658b1df360
TLSH
T112110A9155244152B9B321000B2745602FB59F1A30D7CA1A41C9D963372BFCFC4AE38F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
MD5 826ab855bf3d4cfbe442e5c29341c742
SHA1 0f76eaef902a256221ca8d309b46e480113669b9
SHA512 d053526e1ec45b6667699689e80ff30237a860dfa35bfdbef2885d8c525e47b3886fa17e3ae2b35e69601305ef450ccea60dc85e6023cf0ea3e20777a26ddb02
TLSH
T1D0F0E28696214016FAF322100B1B49553BB5DA2731E6CB0940C8D9A37627ACF84AD29F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
MD5 89d42ed52b434f87f3408bf635d31183
SHA1 152a56d81427313371addead21536d631fc8c7fb
SHA512 392c0c0b574b88b790a35dc4c295723f14e5a02b0fb8e8705ae767131312fc9aee7fa41411f808a35c6408b8932b8d920020092f9ac518542da0fa5d30d356c0
TLSH
T13A01F58656214017FAB322100A2B49642FB99B2731D7CB0A11CCE9937617ACFC4AC29F
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI36E9.tmp

Path C:\Windows\Installer\MSI36E9.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3F92.tmp

Path C:\Windows\Installer\MSI3F92.tmp
Size 74KB
SHA256 be2ead50c4cd94d33c7f1e7c00b47744cb4b4309dcb349236cdcd447265ecf4b
MD5 d557e10dd63535aae79b780fbf83961d
SHA1 67fdf4459fab259f61da7ddd342261243b916a94
SHA512 ab7d5ec81a3e4367b51deac213da79f9b3a6f5be505f4900121b19bffee4366dabf9674753f6ea82e35a88080b85b1e0f2eca790630f879f850aa322e4068feb
SSDEEP 1536:C/sWkKt5Qr09UcBO8IDNg3D+VYBli7woHKy5bJuR3nW+d:SJ5Qr09nGe3D+VYawa5bJc3nW
TLSH
T10B739D213651C375C19728B5E57AC2716A3E74201FE488CE7BA60B7E5E322C17A7B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4DFE.tmp

Path C:\Windows\Installer\MSI4DFE.tmp
Size 97KB
SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1 a520426523be085ec67291241f4219ab13f4d4b8
SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
TLSH
T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8117.tmp

Path C:\Windows\Installer\MSI8117.tmp
Size 27KB
SHA256 09967ad0cf7d97a623a91539280ef1a124bd0555c24806398b18c3d1e41c9616
MD5 7126f5eaa1aa0936821749691a1fc988
SHA1 bcbda2aaffacbaccef1a249b8d0e0904ce379774
SHA512 33b7f9db83c25faf003a30c42e2a8ba4b6459bf4fbb249cb16374c584fc625c9a57cb750444daad745e3dfd64c14849d70a248940214261ce48e1113c29a3801
SSDEEP 384:arx21uO9FT06Nd5ozVl2clwtp1qxhANsp6damYKJYhXq+KxI1J6EbTuiOFAgac:ark1j9FT0md5oVlwK2srWoq/QOFAgac
TLSH
T1DAC27D0178ED43BAD4F3DD76593DA2B0A63AA4112571D4CD0B178A6ADD33281AB7F30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{358033BE-39ED-4CD3-861B-28547EF973CC}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{E9062597-9284-44EE-8F6A-F2A854A3E481}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{E9062597-9284-44EE-8F6A-F2A854A3E481}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v4.0.Framework.dll

Path C:\Windows\assembly\tmp\0WT47FT3\Microsoft.Office.Tools.v4.0.Framework.dll
Size 30KB
SHA256 8b1af886189a4f9610d1e38aca9d71cfd137e0ecb326d7c46cae9264c3faf097
MD5 7fdb0de95e06f278b3a08581f25a435e
SHA1 f7b03fcd3c6d8c4dd1e65a689a73acbfe5c2a3ee
SHA512 8a289b9c4c82c3d8c22bfdaf57aa0416de14f6bcb22e9a3e10630fc158c65c48fa012a8946423950a65722fcdd0f3c643fee116ad848bd802aed4347a973c19e
SSDEEP 768:aHaVFSvPSNEtyJvrpc49qFkByBehN99zeXDF:Y29rQFkByBehxz8DF
TLSH
T19FE2185087FC136BE9AB0A707EE5D8815D3AFF526D62E21F4058C05E14F5BE4CA62327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll

Path C:\Windows\assembly\tmp\19LQ8ADF\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Size 64KB
SHA256 e36435590e80c1d27493fbb9cc2f7a402fb3207e7210d134233099d1c01cbe8c
MD5 64939e920a0619adb8e395877237b560
SHA1 c05ecc9674f7a9436a227da429b474910a163d9d
SHA512 05281db2372f72aa9ab44ac3dab79a3e506390ac6b317180273a32d6a4f82f36128b75ad7e706333dfe318766e21ec8f42a72e55b875faf86e152d4d592b624e
SSDEEP 1536:ZZan8MPqcyyaZM+TeVCB5+G9cTvdQc1bqMsmjhGBDypyBeQjzQC:lMPG7wqLDy8BtjkC
TLSH
T1F6532A2893F84723D6FF83B8B9F191435A76F543AE61CB6E18CA938908533D4491376B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll

Path C:\Windows\assembly\tmp\3FA8Z0U3\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Size 155KB
SHA256 ac12705a2b9470ef07732f500bcd8b2844282be1f609f5aa74b0dd3f0268362b
MD5 7a17537e156d75e293aa693423fd0fd6
SHA1 2bafdfe9348c0a39dbfdca35d7a04d925bdc82a0
SHA512 ab38de8c226a7361d0b1d2adb3929585ebc214ea0b967e7f851891f4c2c451030fa38cd8c3978f881ccb90339e40272c0522aaffae8073e9a4c3467eb3118fa6
SSDEEP 3072:i0anyn/CiBk6HOIz42IJqFF/0/QAWwTrjeK4BED:2n+VEn08
TLSH
T108F32A5A63EC0716F6FB0731A8FA54416EBAF8132962CB5C2C4E45DE05B1B908673B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll

Path C:\Windows\assembly\tmp\500ER8PD\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Size 192KB
SHA256 e51a6c5e34b5e1ac743fca62a8c8d82f3e5099914745664a23843f6276e89039
MD5 91cc9825305d8554054d097b5418d7fd
SHA1 750eda13cddadf3f38de3df25062cc4774e019cd
SHA512 c1c82bd4859e0db7763f6e11425eb02270cec54ce79c0f848e1be5cab2c1715b7e9a96f12d9d2f11d5418881596837b3fbf84254be9e77e84b01a2b11c646802
SSDEEP 3072:0cs+QnXsia21rUBJeImxRGluQriZY+/ZCX/kMrICBX0a:0csrRIHiBtkb
TLSH
T1F3142A2467FC1B15F2FB0B7AEDB5A0019A76FE662913D31D15A0419E1872F80CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\9I87U37N\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Size 38KB
SHA256 b2673e6faf166a80f9f3832234508d25f3d219eafb6ba1d8d16583aff3517793
MD5 792d885a3d06f829956b3f0461789f4f
SHA1 f5d023f2dfcfb369bfeed2815da8c1ca54a948f4
SHA512 55e82a9ac9a9bf8a3f3dfbe4e529629a11a1df48774874509b71e062d7f754178b3a87f49d8d46580cf3aa9af52ba03747c980c8422456538d6c52102f1ce24d
SSDEEP 384:Tght+fMtSM9jmxa1CFbdKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+3HW88NWXsY:TgX+EtkqP6rqnGKKyBez69zo
TLSH
T18603B629D7F84312E2F747B09CF584837976FA53AE38DB6C15C5934948237848A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.dll

Path C:\Windows\assembly\tmp\9VRMJV9R\Microsoft.VisualStudio.Tools.Office.Runtime.dll
Size 393KB
SHA256 2bcd529d5c2edf88d3b658816d72d1207df773ffbe805e7b5070802782c23c67
MD5 8640c74199160c6e932a5f55cac9d9c8
SHA1 661d08a2ca504c0e056bf3ddf500d9cf610ecb42
SHA512 7c06470c6ac2c7bb8bdc4fdaa81c765c810208200f059fef2cf0ddb9d815fca705964fd062d187e4e189127096690ad5ae9f4a74c5ab12b486057141e3f46332
SSDEEP 12288:P1lzmzzzzfzxVzzdqzzzzHUzJz8gXUAaBn:NlzmzzzzfzxVzzdqzzzzHUzJz8gEAa5
TLSH
T17184E62073F94218E9B70B31ECBA41C51B76BE67BE15CA1F2445315D6A72B52CB22373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.dll

Path C:\Windows\assembly\tmp\D65JG7Z5\Microsoft.Office.Tools.dll
Size 18KB
SHA256 02d0d460ec66aca17204ef8f7244e2e34e117c7f20aa07e98cb83a1386a1146f
MD5 c7af388d0d92544cbc307cc692f6dc1c
SHA1 660b07bf79682e91b23824fa327950bfa8c73f01
SHA512 5a8d81ed8fce9eac5175c676f7db4cc147f4f2999cc9e010de4bf87c79bd106c45d0c8848f1cb0eb61a7ad7cf33d2d4881f9cce588cce4d841bcaa66ec8f187e
SSDEEP 384:H1LtwmrH+WAnmkW/MwWVsLBiHRN72lkPtHNsAR9zkwm/:H19AZvyBe6kFts89zni
TLSH
T192922A55D7DF8EA3CC622C709DF4D7423E3CA7835D12DA2B0689E5192CB3394C521729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.dll

Path C:\Windows\assembly\tmp\G2S93E1G\Microsoft.Office.Tools.Common.dll
Size 93KB
SHA256 1f9e5b3df61e6ae400905e38ef3e3c8208698a488305554dbe9293887ffa6478
MD5 d75541051253a7528d7c14d60fdb3e27
SHA1 e03b4457b01aaee52fb01967a781d10001c6329e
SHA512 5399fdd80de5492ba106c8b29d87d4a6ab0ac329ab1f882c13662a1807b86dee5c2fb667ffd39b87d664b0baeaaa30738aae7b516e048a0f606abc01a9647cce
SSDEEP 1536:ey+zGztUjm2oNIv5oiIZZB8CFD4W8yBeNzfzx9:tzhNw5yjVDB0bl9
TLSH
T1CB930626A23684BDDDC9103C74983531A73CF3B78246A7871909BDAA4DD3BCBC987749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\GDEVTUZ8\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Size 38KB
SHA256 d182d18bbf9526dd0eb821eabddc885b80ba8f6dde2c9e0bb809fb55c14c7c47
MD5 32c152242c691677b866356014498d2d
SHA1 fc75591a894f0e8b5aecbd0bd13e3184df0c4f38
SHA512 bdf69a1b755f176e958f6d4c4e2e7c3ae74000a43266873ba602436c089983d0ebcf6e26344a15d8b2001ae74a798b5dacdbdd7cbc206426783704b036e05831
SSDEEP 384:bKQOJrYa7mdessomj5R/yeizfa19crXKJ9Yu6dnPU3SERztmCJMadMardz/JikPF:OQOVYoxVUq+w6rqnzxAzpL5yBeL19ze
TLSH
T15A03D628C3FC8326EAB347B0E9F5D4876937B553AE75D7AC1589630D18227848523B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.Implementation.dll

Path C:\Windows\assembly\tmp\GXSPTVND\Microsoft.Office.Tools.Word.Implementation.dll
Size 337KB
SHA256 2585cc5fcf73680a5124d8e0a08a27d311ba903cd7bbffee7adbbf8d188c5f28
MD5 87d634d0fd6f8e13b0141730916d78a9
SHA1 8591e58967be097ab8f711395ec0b55f72d902d6
SHA512 cf0445d2d697f256d3421ee480eca5ad83d3c897c8477fd30828def534b2a45b72f5dd0e177dedad61283d28211707d7eec3661306b3c504203ac36beca377d6
SSDEEP 6144:FtlRAWy0iDCyVMvUYKZ+JICHNyPOc9Yh9g:FdXyyuMvQZ+/rc969g
TLSH
T14B741B154268C32BD5E8C235BCB136124BBDF293BEE39B2B613695A81CD37D0CC25997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll

Path C:\Windows\assembly\tmp\H094SQH6\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Size 134KB
SHA256 df0deac24f6371b26da9f34c1ce21e7d3fb7e4a4d75c42745c265b4639cb3e82
MD5 d8d3a7296bfe05f2355f96f526f1dce7
SHA1 f1ec56517cce54f75fc3b8cb3f82f901cb3d96af
SHA512 67f3816e595f472f3d67983e7207cbd643a2ccc3f6187bd94f2ca32dc2cfac3fb7daee7b5b05aa8ce46d829b99687cdfa4f34e802835b90955b126cfabadff48
SSDEEP 3072:ON1zvAuFvVyV2sUz8mqc9AaZiNhxm0bBzC:OTv5tAaKWQe
TLSH
T186D3D41B93FC0269F2B70B70EDBE94CA5877BD566C21D25F044A764E10B2B809A72737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.Implementation.dll

Path C:\Windows\assembly\tmp\JCKTS6WO\Microsoft.Office.Tools.Excel.Implementation.dll
Size 459KB
SHA256 1e9f1d847daaf224c7b1ca265ecb7bc293b0df70b3a299b5da3bdb2978bc7df5
MD5 2c93d41b14f129c61d2993baaf2e002f
SHA1 96e54e9b760391683eb617baf03aa444d124472a
SHA512 21808de680825d1a1a2cd003bd5b479c2ae725e54071ebe4e8aff5b0fb000ffea3eba1ece98631ab3065a8cf6c2786c1d9059712931e2fba0410c7a2b53e31d5
SSDEEP 6144:y6g4wRumoEBSvGpDMCDC1AW4e+TF/AVaqmRQGtIhyjmDs3lNiuNfVdKy9:y6jwRSvQh42RNjN6AVdKy9
TLSH
T12CA43C12C269D33EC2AE833750A226155BA5B2EFBAF1EF57A013C5E82C537C09D41E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.dll

Path C:\Windows\assembly\tmp\KXGD0HLZ\Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Size 84KB
SHA256 cd56f6c0e64ea02f2a76c880a55721929dd7a2d9eced52b82122618dc2b34c18
MD5 1150e66eaca3d36ef28a7551337b6ac6
SHA1 ad37ef180a8d1c81cbdf1595bdc802ba070cb03a
SHA512 a2862ac8fd62d4261427c2217d9c02d8df5dd7f4d3a0db0bd826421050d6ef8e39e8f630f079622905dc343e16f42c1d80724e1d4132d4c9d068f089d50084c6
SSDEEP 1536:nb4VV8XW/Og9NCJ7qBEPzm42yEAWQ0yBexjzQEsC:n2dWqQmyz1LBUjk8
TLSH
T1E383195587FC4716E6B74B70F9F78447AA33F967AA23C78D1408824E2851BA4C4E273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Common.Implementation.dll

Path C:\Windows\assembly\tmp\LNV0LC2U\Microsoft.Office.Tools.Common.Implementation.dll
Size 354KB
SHA256 1bc4ff4e9cc85d9457e80276354f643028c01c25414d0e81450bb52ed802e93c
MD5 00ee8a57705bf407a2fa0606b144a13c
SHA1 3c9a6ed3cdb6d167da2ac38518c3820985e4b6b0
SHA512 9197e0ce0e8979b7d8c8e5b95ef5b9bf22fe8cc803b26c97b3c44d1d9e095f85a2a205eaa57152a9843b8fdb7751bdbc1e64cb3f3f04d3952537428cb427fc93
SSDEEP 6144:iNeM8oM6s8alZ+afj5OAKOQ4pUE9wttHqr:O9QZ3j5IOQ4pUE9wttKr
TLSH
T18874A415A3FE5761E2F70B34ACB40489DAB6FD479E6A974F2445A14E1C32F80C962F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Excel.dll

Path C:\Windows\assembly\tmp\LQ92S4GM\Microsoft.Office.Tools.Excel.dll
Size 171KB
SHA256 a4397784c26adfec3393dc421d27f826099a19f1d55b64a2e6199d977a37515a
MD5 acf3804fead07de2fc137e95a57494ec
SHA1 d8b82e20db36ebf1dd2b27d8f301e59c0fc62565
SHA512 e21e42e012a0599f99c812ce4cb520d9219ddda15fe5c05241b6aeb17d0df4103877c81877a75b55271b389fc12c2ad822c2e4ec8e72a750d17b8e22829c3736
SSDEEP 3072:VWwMr8CSQ0dd5Xqp6J7OB6530Xgb3m61EC6r2vamSxBAZirZANBtJ:VnMr8CSQ09ap6Jy65Rm2v22v
TLSH
T1730419C1AB0BE061DCC9563C38AA7B056F3CFBD295D2EB0BC50DEDE42493784C64569A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.Implementation.dll

Path C:\Windows\assembly\tmp\MLZTNWP3\Microsoft.Office.Tools.Outlook.Implementation.dll
Size 140KB
SHA256 326bdb32503351a9b99fe69eb884a5a02d4bff0ff2c7b8b3ce9674fab9fcfc31
MD5 0f7bc383c04833cfd5e6d6f6d5b9f9c7
SHA1 29f672f4c8dfb820e42b54a9924e93ede94481aa
SHA512 d3a7b278a7244c13a887d2a50b8aee39af38fa8dc02f7566a3c9b6e02f25415e2e009cc118d923d22c55c223961657d832a445f897adb4a5649d70e9e9cd2d8f
SSDEEP 1536:oBjLPfRUqxc0O/t4DErSu9e7EMaggaqRuDPR6TCZByBe9zi:oBfPJUqxy14DEF9e7D3gaqR4PGIEBi2
TLSH
T147E31B00A3AA0B92D07555341BF2B542EA3DFBA72AD5E75F5411CED80CB3B90DC22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Word.dll

Path C:\Windows\assembly\tmp\MO2799ZU\Microsoft.Office.Tools.Word.dll
Size 142KB
SHA256 bf5406b6657cc7aca2db714ec375efc3ffdf4cc32a80f938b3dfa502ebdd26f9
MD5 b24ae31036dc11fe6239397a22e8c659
SHA1 40d2739f8d2c19db095db4ef4f1a9cb6bae7880e
SHA512 c713095f297a37458edba5f9bbd6e04e9407089b3f8e98f9c3c52e9711a8be01a3e7268ece3837d1e0438588c50406eacf7afa5bab08d2ceba68dde76ea27915
SSDEEP 3072:jrwVY+eaNZzPM8s08xsNj4SwAXK7Vs2gM2HO8+rCo7VBpdfh:jrwBZWkge7DuV/7Tfh
TLSH
T1C3E34A91EA35C259CE84C47D3E21BB00DB3CF3D644C2A79F4526FCE80A9B791C552E9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\MPYMHKMS\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Size 44KB
SHA256 436215d03a6cd3b30d6b2e7006aa4a83f7c3291f3fc0b4ad86ff55e70dac8650
MD5 1190dedce8f1b97816123163216dd096
SHA1 468d499041ab141f4233b23d53ffb9a203cfda35
SHA512 fe35ddd5a4a600cf840414f8859691f5894ee779517f3b069f97667e68f6cae54836d393091f828dc9541c6fd9dbac4a77fd53eb3840a8d3dfda8d21373fa710
SSDEEP 384:MBk39BmxOVst4SCtrpuXYa1pbr/0K7yEKJ9Yu6dnPU3SERztmCJMadMardz/Jiks:MGfZs5CZqlj26rqnuMztgyBepmoQ9zpG
TLSH
T14713D769D3F84712D6F74BB06DF1E4435936BA539EA8DB5C145A530A08233D88E22F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll

Path C:\Windows\assembly\tmp\MVZF6WWQ\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Size 27KB
SHA256 eb5162b64d9b6220aacaea4eaa597bdd02880b841db717e4bdca5d64e453b4b5
MD5 e7f28e9b4375963610ea0c6b7cfa09b8
SHA1 0f2157b7bd33fa24a7ba4274c9e5aa05c88a36fa
SHA512 c683d2faefffc02e73d500b40eb91a6055b0582ed16230c47c8030a4b5f8533f075354fb427faca1fcaec6b158ecd015ddbd481033159c2b43a40339a53f163f
SSDEEP 384:rd3K6a/IZa1fKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+CdWbspWLsLBiHRN72f:rd33qo6rqnL56yBeucts89z+1
TLSH
T175C25328D7F84312E2B35BB09DF5C487AC76BA53AE35C79C1586530D08227858963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll

Path C:\Windows\assembly\tmp\S20N49SY\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Size 200KB
SHA256 0f5b5e40b8a1708051250bbc9e36ba35357312503beb0004ae6a2cc5a20466e8
MD5 9828dbd687c6ac093d40dfd61de68a0e
SHA1 9c96f865e83d7deae884321e76c87553c6088748
SHA512 001852557d9bbc33cb9b274277d2e24b63b1d46b253674f13eda857f36bf0718779242621c14809f902df041283c8302164d584a4e42be3ed11a0cef591f7853
SSDEEP 3072:SrFKDbAtgNrfAw1bsO8YzN2HsBpmxRGlu6rirP+R/x3zKFvlBz1:SrFAoOXcHfIfiKkvx
TLSH
T11C142910A7FD1B25F6FB4B79EDB6A0018A36FA263D13D31D15A0419E1876B40CA72B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll

Path C:\Windows\assembly\tmp\U8F3KU82\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Size 65KB
SHA256 12b2e3ab66fa23e2814d937bc24aae3591516e61c667ced481f66a3d55b66a4c
MD5 dd97df24a39663be2d217fbb4bddffd0
SHA1 9ac8d23ec7c8655ae5bb5a62eda61871030b2a4e
SHA512 f0de89568b550f23b60fb4b343682e7b4ffeab9c571127376815d22cbb3b93a2c6081831a24c7fde7977008a72ae4395313202af39e95095d2c3d8360bfdbbb9
SSDEEP 1536:4c7HHzMKpyGZ3Jr249XJqZqSbGJyBeMczZ1:4c7HHzMDG5JdJqZqGGcBC11
TLSH
T1A6632924D3FC4723D2FB87B468F188839A75F7836DA9DB5C1485532A08577C48A63B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.dll

Path C:\Windows\assembly\tmp\W7JYID3Z\Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Size 204KB
SHA256 ed512630534121de6e87259230aa7d67547b810bbe54757b561c9cd86428a316
MD5 6cf6471f917d139fa7f6b57a09156a8b
SHA1 896f482ed5892beed0cf3d74cfd599c2980d485b
SHA512 2192f731aaba560bb91e85ca5282943dc7c4bfde708690808487cb966c1051ead73f63a71f75cf52d7fcfd9141fb82c3f2d1edebaf21ee87601aa5deeca82cc1
SSDEEP 3072:00uKb2fEejyG2iPklibcruOVTzk21wxqWX58Kn8p6/A/C9hSrBbQ3t4N3BMjkf:b8cXqcfDKQCGP
TLSH
T1F6144B5663FC0726F6BB0B35D4FB11026E76F8172A53DB0C688A469E1971B808A73737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll

Path C:\Windows\assembly\tmp\XI41DFCI\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Size 360KB
SHA256 25e23e4bc78db831a05fad7dc758354a932278b42b1b7277b62a75c717e89edf
MD5 5cb69e557b5b117597246c9e67cfdc8c
SHA1 f36af240ff34cc7c11c6ae1f0d67a0abf1496576
SHA512 9af38e10fa70186abf4088e86a9b45b79b4e6a41d20348f56da07fd8415ebf5d3695b8ef41962bb39310f5dd3436c2cbe70ba3982c720d7beb7b80b5ac6b1616
SSDEEP 3072:RyWCQQzXgPice1NvAbugFh/jLqthte2Seh66LikrKwQp91sq9kAatVrmCK2phJRS:UWCdDiyvgmiL54AaXDBP8v
TLSH
T1B174D62073F95208E9B70B30AC7692C51A76BE677E15C62F2449314D6AB2B53CB23773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.dll

Path C:\Windows\assembly\tmp\YBQB60RT\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Size 78KB
SHA256 6ca890e728f1bffe2cdc670938d9c17729903f9eaade142775954ee5129b78b2
MD5 8ca4448d8a87d4edc29064678840a65b
SHA1 389ee39f6060e9b31a379e65d3c998a3dbe83b40
SHA512 b86efff7aff40a0d2750d6c4db6ed7095eb942720b972350f8cc87dcf3c666b09865befe885a57058eaa1e7aa3c5c56119324a445eabe246f52d236fff834483
SSDEEP 1536:yskby0ayhkM+TeVCB5+G9cTvdQc1bqMsDNb//pasgNiiHyBeljzQz:yDbyihcwqHba3NbSB8jkz
TLSH
T19673081497BA4FA7C2BA4378ACF1424256B5F403AB52CB6F18855F481C73B94CD13BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.Outlook.dll

Path C:\Windows\assembly\tmp\Z7HNJA6I\Microsoft.Office.Tools.Outlook.dll
Size 58KB
SHA256 89d6f51dbcddb10ea2c4e92e6360e9fc2c917cd8d9f1aa162d6a47f7e940d899
MD5 6c7bc83cf1080985bb2505ed9c090c86
SHA1 64fcb206e3280b935c786d72ba34ad854bf74c7e
SHA512 8b2a1d334f01e7997bb6b5c7752d9a275714b811ebb293e95bd9b1be7d2bb44484998ab1fc1845fb7e6f4df4613082fa4ed552a4994961fe611a92b93e0ca9e3
SSDEEP 768:jRXrTM8QOkqNHEJLgp9DItLnKDiQ0fWS24nbxocNAwkEGjhl2BOBaBnD/sxFsN/4:SSk2HQq9D4bg3yBeOkmVzpqZ
TLSH
T1BF43A382920A96D6CC55A5742A70FB52E63EF3FB1BD0B65F8813DCF408A3250E905F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_000_vcRuntimeAdditional_x86.log

Path C:\Windows\dd_vcredist_x86_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 a9340e4874f57e757085d97a48654483a2902c72bdd4eacfbe5fbc203cc1ea64
MD5 aae71bf0b8ae946263c8ea5e53f3a107
SHA1 a2f34c05f49a66d481d07d7cf7300215bfd016af
SHA512 1b0ee7d9b745e3cb49e3e6f6bf8ca2173eaa6c0a905c2202668622d3d16c360f62d1e452cf0cbdd8696de48282b2797d09c6698777dd0d9c41a05866d2904ad2
TLSH
T10041F5791FE41899B1B397079FF3C0534E33FDD668348B0D2388831A466BD09A9983A7
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_001_vcRuntimeMinimum_x86.log

Path C:\Windows\dd_vcredist_x86_001_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 73326ab0476d9ab36b54d5103641ca150b91af14002709649c2804893d7070fa
MD5 5f25890bd377867fbb75e0e0ce1eef28
SHA1 e4bea92053a714d8d2fbc9051cfd5c872006b23a
SHA512 8cdacc54372b19709934ea9322595f8d886cf57a666233e35ae4478dc9e5a1f863fc2b46dd0a46d2f78381dce00640e557679f92550a34e987999befb074283d
TLSH
T1C441D3681EE50886F1B357479FF3C1534F33FDC268748B0D2399835A06BBD0998987AA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/884-1990-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/992-1989-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/1108-1956-0x00000000007C0000-0x0000000000837000-memory.dmp

Download

memory/1500-2659-0x0000017DDAE60000-0x0000017DDAEC6000-memory.dmp

Download

memory/1500-2787-0x0000017DDA9C0000-0x0000017DDA9D4000-memory.dmp

Download

memory/1500-2610-0x0000017DDA9C0000-0x0000017DDA9EA000-memory.dmp

Download

memory/1500-2606-0x0000017DD9750000-0x0000017DD975A000-memory.dmp

Download

memory/1500-2617-0x0000017DDAA80000-0x0000017DDAAB6000-memory.dmp

Download

memory/1500-2603-0x0000017DDAA00000-0x0000017DDAA34000-memory.dmp

Download

memory/1500-2623-0x0000017DDAB30000-0x0000017DDAB64000-memory.dmp

Download

memory/1500-2620-0x0000017DDAA40000-0x0000017DDAA58000-memory.dmp

Download

memory/1500-2626-0x0000017DDABD0000-0x0000017DDAC2C000-memory.dmp

Download

memory/1500-2629-0x0000017DDAA60000-0x0000017DDAA7C000-memory.dmp

Download

memory/1500-2599-0x0000017DD8A90000-0x0000017DD8A9A000-memory.dmp

Download

memory/1500-2635-0x0000017DD9B20000-0x0000017DD9B28000-memory.dmp

Download

memory/1500-2897-0x0000017DDA9C0000-0x0000017DDA9E6000-memory.dmp

Download

memory/1500-2647-0x0000017DD9B30000-0x0000017DD9B3E000-memory.dmp

Download

memory/1500-2653-0x0000017DDAB70000-0x0000017DDAB82000-memory.dmp

Download

memory/1500-2890-0x0000017DDAA30000-0x0000017DDAA96000-memory.dmp

Download

memory/1500-2665-0x0000017DD9B40000-0x0000017DD9B4C000-memory.dmp

Download

memory/1500-2883-0x0000017DD9B20000-0x0000017DD9B36000-memory.dmp

Download

memory/1500-2674-0x0000017DDAD60000-0x0000017DDAD88000-memory.dmp

Download

memory/1500-2690-0x0000017DDA9F0000-0x0000017DDA9FE000-memory.dmp

Download

memory/1500-2698-0x0000017DDADF0000-0x0000017DDAE04000-memory.dmp

Download

memory/1500-2877-0x0000017DDAA20000-0x0000017DDAA78000-memory.dmp

Download

memory/1500-2694-0x0000017DDAC80000-0x0000017DDAC94000-memory.dmp

Download

memory/1500-2871-0x0000017DDA9C0000-0x0000017DDA9E6000-memory.dmp

Download

memory/1500-2865-0x0000017DDAA40000-0x0000017DDAAB6000-memory.dmp

Download

memory/1500-2686-0x0000017DD9BA0000-0x0000017DD9BAE000-memory.dmp

Download

memory/1500-2858-0x0000017DDAA20000-0x0000017DDAA7C000-memory.dmp

Download

memory/1500-2671-0x0000017DDAED0000-0x0000017DDAF28000-memory.dmp

Download

memory/1500-2852-0x0000017DDA9C0000-0x0000017DDA9E8000-memory.dmp

Download

memory/1500-2668-0x0000017DDAC60000-0x0000017DDAC7A000-memory.dmp

Download

memory/1500-2845-0x0000017DD9B20000-0x0000017DD9B32000-memory.dmp

Download

memory/1500-2662-0x0000017DDAD30000-0x0000017DDAD56000-memory.dmp

Download

memory/1500-2838-0x0000017DDA9C0000-0x0000017DDA9EE000-memory.dmp

Download

memory/1500-2831-0x0000017DD9B20000-0x0000017DD9B3C000-memory.dmp

Download

memory/1500-2656-0x0000017DDAD90000-0x0000017DDADEE000-memory.dmp

Download

memory/1500-2825-0x0000017DD8A90000-0x0000017DD8A98000-memory.dmp

Download

memory/1500-2819-0x0000017DD8A90000-0x0000017DD8A9C000-memory.dmp

Download

memory/1500-2650-0x0000017DDAC30000-0x0000017DDAC56000-memory.dmp

Download

memory/1500-2813-0x0000017DDAA00000-0x0000017DDAA34000-memory.dmp

Download

memory/1500-2644-0x0000017DDABA0000-0x0000017DDABCE000-memory.dmp

Download

memory/1500-2806-0x0000017DDAA00000-0x0000017DDAA36000-memory.dmp

Download

memory/1500-2641-0x0000017DDACB0000-0x0000017DDAD26000-memory.dmp

Download

memory/1500-2638-0x0000017DDAAF0000-0x0000017DDAB08000-memory.dmp

Download

memory/1500-2632-0x0000017DDAAC0000-0x0000017DDAAD6000-memory.dmp

Download

memory/1500-2800-0x0000017DDA9C0000-0x0000017DDA9D8000-memory.dmp

Download

memory/1500-2781-0x0000017DD8A90000-0x0000017DD8A9A000-memory.dmp

Download

memory/1500-2613-0x0000017DD9880000-0x0000017DD988E000-memory.dmp

Download

memory/1500-2715-0x0000017DD9880000-0x0000017DD988E000-memory.dmp

Download

memory/1500-2722-0x0000017DD9880000-0x0000017DD988E000-memory.dmp

Download

memory/1500-2728-0x0000017DD9880000-0x0000017DD988E000-memory.dmp

Download

memory/1500-2735-0x0000017DD8A90000-0x0000017DD8A9A000-memory.dmp

Download

memory/1500-2742-0x0000017DDAE10000-0x0000017DDAE3A000-memory.dmp

Download

memory/1500-2748-0x0000017DDAA00000-0x0000017DDAA34000-memory.dmp

Download

memory/1500-2755-0x0000017DDAD90000-0x0000017DDADEC000-memory.dmp

Download

memory/1500-2762-0x0000017DDA9C0000-0x0000017DDA9DA000-memory.dmp

Download

memory/1500-2768-0x0000017DD8A90000-0x0000017DD8A9E000-memory.dmp

Download

memory/1500-2775-0x0000017DDA9C0000-0x0000017DDA9D8000-memory.dmp

Download

memory/1500-2793-0x0000017DDA9C0000-0x0000017DDA9D4000-memory.dmp

Download

memory/1956-1873-0x0000000000350000-0x00000000003B5000-memory.dmp

Download

memory/2308-1722-0x00000000007C0000-0x0000000000837000-memory.dmp

Download

memory/2384-1876-0x00000000007E0000-0x0000000000845000-memory.dmp

Download

memory/2396-3-0x0000000074B50000-0x000000007530C000-memory.dmp

Download

memory/2396-717-0x0000000074B62000-0x0000000074B63000-memory.dmp

Download

memory/2396-1272-0x0000000074B50000-0x000000007530C000-memory.dmp

Download

memory/2396-1-0x0000000000180000-0x000000000019A000-memory.dmp

Download

memory/2396-0-0x0000000074B62000-0x0000000074B63000-memory.dmp

Download

memory/2396-2-0x0000000002690000-0x0000000002696000-memory.dmp

Download

memory/2952-1618-0x00000000007E0000-0x0000000000845000-memory.dmp

Download

memory/4000-1874-0x0000000000350000-0x00000000003B5000-memory.dmp

Download

memory/4592-1875-0x00000000007E0000-0x0000000000845000-memory.dmp

Download

memory/4812-1721-0x00000000007C0000-0x0000000000837000-memory.dmp

Download

memory/4864-1851-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/5264-1849-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/5468-1719-0x00000000007C0000-0x0000000000837000-memory.dmp

Download

memory/5576-1957-0x00000000007C0000-0x0000000000837000-memory.dmp

Download

memory/5844-1847-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/5864-1619-0x00000000007E0000-0x0000000000845000-memory.dmp

Download