3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23

Analysis

max time kernel
101s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VisualCppRedist_AIO_x86_x64.exe
Size 30.1MB
Sample260910-pm1ekashnb
SHA256 3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23
MD5 1a7523d92b573859df4cbe8e75509b9e
SHA1 65b0ccf1fe1f23c4a0557b8a30251cc7e70a1f73
SHA512 f7c684c00265402876a4159869774096090c7482358fa1882a50468c89483c9a30066667418d510dcc5b9780fbdfd1bcc6672f92ec53cb933c0b36292c6ec40b
SSDEEP 786432:4JVdGL3z5NXeyQIwJtNYUJwif0nOJa9WEWRIOG5B7DVGLhYNBFv3cnZCa:gjOLXelIMjJwi0wMVW6n7ShYWCa
TLSH
T10E6733B51858C4B8E7E0B1F00807F5E1769AF9BCE9C5CC46B1F4BC99A19E4618FE612C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence ransomware

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
712	vcredist_x86.exe
5100	vcredist_x64.exe
4240	vcredist_x86.exe
3232	vcredist_x64.exe
2780	VC_redist.x86.exe
2484	VC_redist.x64.exe
5552	vcredist_x86.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5632	vcredist_x64.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
5328	MsiExec.exe
6088	VC_redist.x86.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3956	MsiExec.exe
3032	MsiExec.exe
1116	VC_redist.x64.exe
2960	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2220	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe
2356	MsiExec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\atl100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100jpn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100rus.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\atl100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\vcomp100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
4856	cscript.exe
5008	cscript.exe
4684	cscript.exe
3736	cscript.exe
2536	cscript.exe
1352	cscript.exe
1448	cscript.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFC4A7B0E41B8955B7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID82A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8233A28F6C210550.TMP	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914687.0\mfc80KOR.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914763.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922075.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_942a41ec.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDDD3.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260910132922103.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3A9A61AE08DEE4CF.TMP	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100enu_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914687.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922078.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_6510b4f1.manifest	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEDB0D6A0815FF0C7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6820142CEB530986.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3A9363BD4219FD40.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82C.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914577.0\amd64_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_d7470ca6.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260910132914791.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID9E6.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100ita_x64	msiexec.exe
File created	C:\Windows\Installer\e5aaa48.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922108.0\9.0.30729.7523.cat	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260910132922078.0	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5E7836DB94F95B64.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC131.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_vcomp100_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914687.0\mfc80CHS.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914802.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4F.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260910132914772.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID85A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF64E485B49FC30D8D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C9B.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922078.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_6510b4f1.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF43.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aaa49.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922108.0\9.0.30729.7523.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260910132922075.0	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922075.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_942a41ec.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922083.0\mfc90enu.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7F.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914641.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914687.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\SystemTemp\~DF02A62F6571520B85.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE755.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C4.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922087.0\vcomp90.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA17.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914763.0\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4B3E77AC1BFFECE5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE384.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100fra_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100jpn_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F7.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914641.0\mfc80u.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260910132914802.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132922087.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_b0616a48.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA1C.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100esn_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260910132914687.0\mfc80ITA.dll	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1456	cmd.exe
5612	cmd.exe
2336	cmd.exe
2888	cmd.exe
3500	cmd.exe
1228	cmd.exe
3400	cmd.exe
1672	cmd.exe
2388	cmd.exe
1648	cmd.exe
5564	cmd.exe
1356	cmd.exe
4180	cmd.exe
1440	cmd.exe
3152	cmd.exe
2964	cmd.exe
1360	cmd.exe
2348	cmd.exe
4340	cmd.exe
5536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualCppRedist_AIO_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 27 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\VC_Redist	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\2 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12B8D03ED28D112328CCF0A0D541598E\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDD54ADF71E8F6333ADE53B6B7C786A8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2005\\x64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\Language = "1033"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC80.MFCLOC,type="win32",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e00530021004900240047002e004f005f0078006800650038004d006b0062004900640046007700550000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CE6380BC270BD863282B3D74B09F7570\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v12	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_x86,v14\Dependents	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x86,x86,14.30,bundle	VC_redist.x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\679E80FBE29B63345BF612177149674C\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_X86,V12\DEPENDENTS\{61087A79-AC85-455C-934D-1FA22CC64F36}	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32-policy" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800360034003e0064002a007400210037007b006e0040006c0033003f0069003000520056007000540037005900420000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8520DAD7C5154DD39846DB1714990E7F	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V12\DEPENDENTS\{EF6B00EC-13E1-4C25-9064-B2F383CB8412}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12\Dependents	vcredist_x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\Dependents	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.ATL,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64" = 2c006c0076006a0060006f002c0042002d00400050002e0059002e00430039007300560073003000560043005f005200650064006900730074003e007b004c0046003d0042004900620074004f002800650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\FDD54ADF71E8F6333ADE53B6B7C786A8\67D6ECF5CD5FBA732B8B22BAC8DE1B4D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList\PackageName = "vc_red.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\ProductName = "Microsoft Visual C++ 2005 Redistributable (x64)"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="amd64",type="win32" = 3600540043006c0046002e005f007400740035006200290038002100600024004b005a0046006d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800360034003e00560034007a0074005300470049005b00460038006c0075007300760051006800770043006f00340000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\SourceList	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
528	reg.exe
432	reg.exe
4536	reg.exe
4436	reg.exe
864	reg.exe
120	reg.exe
1128	reg.exe
5464	reg.exe
4716	reg.exe
5948	reg.exe
4524	reg.exe
4112	reg.exe
2352	reg.exe
2888	reg.exe
5684	reg.exe
1920	reg.exe
4248	reg.exe
2536	reg.exe
3728	reg.exe
5000	reg.exe
4148	reg.exe
4160	reg.exe
5624	reg.exe
1572	reg.exe
4232	reg.exe
4628	reg.exe
1524	reg.exe
4816	reg.exe
1964	reg.exe
4992	reg.exe
3312	reg.exe
2444	reg.exe
5648	reg.exe
5496	reg.exe
3908	reg.exe
1400	reg.exe
5072	reg.exe
3652	reg.exe
4864	reg.exe
3412	reg.exe
1260	reg.exe
2748	reg.exe
5000	reg.exe
1448	reg.exe
2500	reg.exe
6028	reg.exe
264	reg.exe
2844	reg.exe
3972	reg.exe
5800	reg.exe
3020	reg.exe
3324	reg.exe
4280	reg.exe
716	reg.exe
1428	reg.exe
4172	reg.exe
4024	reg.exe
2876	reg.exe
3236	reg.exe
6088	reg.exe
5176	reg.exe
1516	reg.exe
1508	reg.exe
5252	reg.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2460	WMIC.exe
2460	WMIC.exe
2460	WMIC.exe
2460	WMIC.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe
3112	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2460	WMIC.exe
Token: SeSecurityPrivilege	2460	WMIC.exe
Token: SeTakeOwnershipPrivilege	2460	WMIC.exe
Token: SeLoadDriverPrivilege	2460	WMIC.exe
Token: SeSystemProfilePrivilege	2460	WMIC.exe
Token: SeSystemtimePrivilege	2460	WMIC.exe
Token: SeProfSingleProcessPrivilege	2460	WMIC.exe
Token: SeIncBasePriorityPrivilege	2460	WMIC.exe
Token: SeCreatePagefilePrivilege	2460	WMIC.exe
Token: SeBackupPrivilege	2460	WMIC.exe
Token: SeRestorePrivilege	2460	WMIC.exe
Token: SeShutdownPrivilege	2460	WMIC.exe
Token: SeDebugPrivilege	2460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2460	WMIC.exe
Token: SeRemoteShutdownPrivilege	2460	WMIC.exe
Token: SeUndockPrivilege	2460	WMIC.exe
Token: SeManageVolumePrivilege	2460	WMIC.exe
Token: 33	2460	WMIC.exe
Token: 34	2460	WMIC.exe
Token: 35	2460	WMIC.exe
Token: 36	2460	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2460	WMIC.exe
Token: SeSecurityPrivilege	2460	WMIC.exe
Token: SeTakeOwnershipPrivilege	2460	WMIC.exe
Token: SeLoadDriverPrivilege	2460	WMIC.exe
Token: SeSystemProfilePrivilege	2460	WMIC.exe
Token: SeSystemtimePrivilege	2460	WMIC.exe
Token: SeProfSingleProcessPrivilege	2460	WMIC.exe
Token: SeIncBasePriorityPrivilege	2460	WMIC.exe
Token: SeCreatePagefilePrivilege	2460	WMIC.exe
Token: SeBackupPrivilege	2460	WMIC.exe
Token: SeRestorePrivilege	2460	WMIC.exe
Token: SeShutdownPrivilege	2460	WMIC.exe
Token: SeDebugPrivilege	2460	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2460	WMIC.exe
Token: SeRemoteShutdownPrivilege	2460	WMIC.exe
Token: SeUndockPrivilege	2460	WMIC.exe
Token: SeManageVolumePrivilege	2460	WMIC.exe
Token: 33	2460	WMIC.exe
Token: 34	2460	WMIC.exe
Token: 35	2460	WMIC.exe
Token: 36	2460	WMIC.exe
Token: SeBackupPrivilege	5544	vssvc.exe
Token: SeRestorePrivilege	5544	vssvc.exe
Token: SeAuditPrivilege	5544	vssvc.exe
Token: SeBackupPrivilege	2168	srtasks.exe
Token: SeRestorePrivilege	2168	srtasks.exe
Token: SeSecurityPrivilege	2168	srtasks.exe
Token: SeTakeOwnershipPrivilege	2168	srtasks.exe
Token: SeShutdownPrivilege	4516	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	4516	vcredist_x86.exe
Token: SeSecurityPrivilege	3112	msiexec.exe
Token: SeCreateTokenPrivilege	4516	vcredist_x86.exe
Token: SeAssignPrimaryTokenPrivilege	4516	vcredist_x86.exe
Token: SeLockMemoryPrivilege	4516	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	4516	vcredist_x86.exe
Token: SeMachineAccountPrivilege	4516	vcredist_x86.exe
Token: SeTcbPrivilege	4516	vcredist_x86.exe
Token: SeSecurityPrivilege	4516	vcredist_x86.exe
Token: SeTakeOwnershipPrivilege	4516	vcredist_x86.exe
Token: SeLoadDriverPrivilege	4516	vcredist_x86.exe
Token: SeSystemProfilePrivilege	4516	vcredist_x86.exe
Token: SeSystemtimePrivilege	4516	vcredist_x86.exe
Token: SeProfSingleProcessPrivilege	4516	vcredist_x86.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
4884	VisualCppRedist_AIO_x86_x64.exe
712	vcredist_x86.exe
5100	vcredist_x64.exe
4240	vcredist_x86.exe
3232	vcredist_x64.exe
2780	VC_redist.x86.exe
2484	VC_redist.x64.exe
5552	vcredist_x86.exe
3060	msiexec.exe
5632	vcredist_x64.exe
3060	msiexec.exe
1912	msiexec.exe
6088	VC_redist.x86.exe
1912	msiexec.exe
2688	msiexec.exe
2688	msiexec.exe
4160	msiexec.exe
1116	VC_redist.x64.exe
4160	msiexec.exe
4632	msiexec.exe
4632	msiexec.exe
2824	msiexec.exe
2824	msiexec.exe
4024	msiexec.exe
4024	msiexec.exe
2500	msiexec.exe
2500	msiexec.exe
3896	msiexec.exe
3896	msiexec.exe
4584	msiexec.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3112	msiexec.exe
3060	msiexec.exe
5328	MsiExec.exe
1912	msiexec.exe
3956	MsiExec.exe
2688	msiexec.exe
3032	MsiExec.exe
4160	msiexec.exe
2960	MsiExec.exe
4632	msiexec.exe
2220	MsiExec.exe
2824	msiexec.exe
2356	MsiExec.exe
4024	msiexec.exe
4456	MsiExec.exe
2500	msiexec.exe
3324	MsiExec.exe
3896	msiexec.exe
1732	MsiExec.exe
4584	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4180	4884	VisualCppRedist_AIO_x86_x64.exe	88
PID 4180 wrote to memory of 2348	4180	cmd.exe	90
PID 2348 wrote to memory of 5072	2348	cmd.exe	91
PID 4180 wrote to memory of 5228	4180	cmd.exe	92
PID 4180 wrote to memory of 3952	4180	cmd.exe	93
PID 4180 wrote to memory of 1440	4180	cmd.exe	94
PID 4180 wrote to memory of 3252	4180	cmd.exe	95
PID 4180 wrote to memory of 2460	4180	cmd.exe	96
PID 4180 wrote to memory of 3080	4180	cmd.exe	97
PID 4180 wrote to memory of 4340	4180	cmd.exe	99
PID 4340 wrote to memory of 2432	4340	cmd.exe	100
PID 4180 wrote to memory of 3152	4180	cmd.exe	101
PID 3152 wrote to memory of 3236	3152	cmd.exe	102
PID 4180 wrote to memory of 5536	4180	cmd.exe	103
PID 5536 wrote to memory of 2188	5536	cmd.exe	104
PID 4180 wrote to memory of 4816	4180	cmd.exe	105
PID 4180 wrote to memory of 2772	4180	cmd.exe	106
PID 4180 wrote to memory of 3032	4180	cmd.exe	107
PID 4180 wrote to memory of 4464	4180	cmd.exe	108
PID 4180 wrote to memory of 3400	4180	cmd.exe	109
PID 3400 wrote to memory of 3736	3400	cmd.exe	110
PID 4180 wrote to memory of 2888	4180	cmd.exe	238
PID 4180 wrote to memory of 1672	4180	cmd.exe	112
PID 1672 wrote to memory of 2536	1672	cmd.exe	113
PID 4180 wrote to memory of 1456	4180	cmd.exe	114
PID 4180 wrote to memory of 3500	4180	cmd.exe	115
PID 3500 wrote to memory of 1352	3500	cmd.exe	116
PID 4180 wrote to memory of 2388	4180	cmd.exe	117
PID 4180 wrote to memory of 1228	4180	cmd.exe	118
PID 1228 wrote to memory of 1448	1228	cmd.exe	119
PID 4180 wrote to memory of 2964	4180	cmd.exe	120
PID 4180 wrote to memory of 3008	4180	cmd.exe	121
PID 4180 wrote to memory of 5940	4180	cmd.exe	122
PID 4180 wrote to memory of 4056	4180	cmd.exe	123
PID 4180 wrote to memory of 1868	4180	cmd.exe	124
PID 4180 wrote to memory of 4448	4180	cmd.exe	125
PID 4180 wrote to memory of 508	4180	cmd.exe	126
PID 4180 wrote to memory of 5632	4180	cmd.exe	127
PID 4180 wrote to memory of 6116	4180	cmd.exe	128
PID 4180 wrote to memory of 4024	4180	cmd.exe	129
PID 4180 wrote to memory of 1128	4180	cmd.exe	247
PID 4180 wrote to memory of 4388	4180	cmd.exe	131
PID 4180 wrote to memory of 1348	4180	cmd.exe	132
PID 4180 wrote to memory of 5464	4180	cmd.exe	133
PID 4180 wrote to memory of 5496	4180	cmd.exe	134
PID 4180 wrote to memory of 5104	4180	cmd.exe	135
PID 4180 wrote to memory of 4768	4180	cmd.exe	136
PID 4180 wrote to memory of 4716	4180	cmd.exe	249
PID 4180 wrote to memory of 4524	4180	cmd.exe	138
PID 4180 wrote to memory of 2808	4180	cmd.exe	139
PID 4180 wrote to memory of 3788	4180	cmd.exe	140
PID 4180 wrote to memory of 5780	4180	cmd.exe	141
PID 4180 wrote to memory of 3908	4180	cmd.exe	142
PID 4180 wrote to memory of 5816	4180	cmd.exe	143
PID 4180 wrote to memory of 4596	4180	cmd.exe	144
PID 4180 wrote to memory of 2876	4180	cmd.exe	145
PID 4180 wrote to memory of 1252	4180	cmd.exe	146
PID 4180 wrote to memory of 1132	4180	cmd.exe	147
PID 4180 wrote to memory of 3692	4180	cmd.exe	148
PID 4180 wrote to memory of 3020	4180	cmd.exe	149
PID 4180 wrote to memory of 1828	4180	cmd.exe	150
PID 4180 wrote to memory of 5908	4180	cmd.exe	151
PID 4180 wrote to memory of 5696	4180	cmd.exe	152
PID 4180 wrote to memory of 3980	4180	cmd.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
"C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:3952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1440
- - C:\Windows\system32\reg.exe
    reg.exe query "HKU\S-1-5-19"
    3⤵
    PID:3252
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:2188
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:4816
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:2772
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:3032
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 50.35719.0
    3⤵
    - Executes a command shell one-liner
    PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:5940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:6116
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4024
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1128
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
    3⤵
    PID:4388
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:1348
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5464
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
    3⤵
    - Modifies registry key
    PID:5496
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:5104
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    PID:4768
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4716
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4524
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
    3⤵
    PID:2808
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString
    3⤵
    PID:3788
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString
    3⤵
    PID:5780
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3908
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5816
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4596
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2876
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1252
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1132
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    PID:3692
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3020
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1828
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    PID:5908
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5696
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3980
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3728
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1332
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1100
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1400
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1412
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2596
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    PID:5096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4520
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2736
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5948
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4932
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4268
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    PID:5176
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3460
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    PID:5284
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1300
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4912
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    PID:204
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:932
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2852
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1260
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2008
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2844
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    PID:2116
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3260
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2924
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5648
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1472
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:528
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5336
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:368
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    PID:1156
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1204
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2728
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1516
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3672
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5804
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    PID:1736
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:256
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5944
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4232
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4436
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2504
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1508
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2416
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4136
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    PID:4280
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5744
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1708
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:432
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:428
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4332
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4112
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5808
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4964
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4628
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3244
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5316
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    PID:2660
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3248
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4488
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5000
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:624
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3436
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5072
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4860
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5768
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2352
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3252
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2236
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4148
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2460
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3080
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3236
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4264
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3232
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4160
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:908
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5460
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    PID:4816
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5108
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5868
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2888
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5836
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2336
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
    3⤵
    PID:6004
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4316
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2020
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:4644
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{8F5BFB37-71B3-439E-9D76-B19CAC528094} {4D4E199E-A6FD-4BBD-9448-4D4FE492E14D} 1968
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:712
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    PID:5736
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{D2951838-FF2C-44E9-801E-57E5597F11A7} {DA344BC1-39DF-4DE3-9463-55925B230CD1} 5896
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:5100
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:5684
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{1E7E607E-2337-402D-B902-24008A4196D8} {4D64D211-1939-4BF6-AB6C-0E24601A541D} 4516
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4240
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    PID:2188
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4576
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{44FFC451-E3C2-4D1E-82E8-379D404D52D4} {E622856F-1624-427B-9963-FA8AE848A18E} 4576
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3232
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    - Modifies registry key
    PID:5624
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=580 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2780
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{920E8615-8811-4DD5-8B5C-9CD122A7D226} {DE5DE452-4CAD-4FA0-9E38-9FDC5BEBDEF1} 2780
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5380
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:1524
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2484
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C1D2DDBC-A6FC-4798-B168-CF34B2119CFA} {2584F850-87EA-437E-84A3-1401607A7796} 2484
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:888
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    - Modifies registry key
    PID:2748
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:2404
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    PID:1360
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3060
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    - Modifies registry key
    PID:4536
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    PID:3648
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1912
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    - Modifies registry key
    PID:4436
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    PID:5548
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2688
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
    3⤵
    - Modifies registry key
    PID:4816
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1920
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4160
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
    3⤵
    - Modifies registry key
    PID:1964
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3972
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4992
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:864
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1648
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
    3⤵
    PID:3156
- - C:\Windows\system32\find.exe
    find /i "TRIN_TRIR_SETUP"
    3⤵
    PID:924
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s
    3⤵
    PID:2060
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4976
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1360
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5564
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp110.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4272
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1140
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5588
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:712
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1448
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3652
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
    3⤵
    - Modifies registry key
    PID:2500
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:1700
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3020
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
    3⤵
    - Modifies registry key
    PID:4248
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:4672
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    - Modifies registry key
    PID:6028
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
    3⤵
    - Modifies registry key
    PID:264
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
    3⤵
    PID:5756
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString
    3⤵
    PID:3340
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5252
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3312
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3896
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4908
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    PID:3700
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1976
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:120
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1156
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    PID:2772
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1456
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5328
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2536
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5864
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4536
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    PID:2816
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2632
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3620
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4864
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4664
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3980
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    PID:4548
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3752
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2728
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    PID:1504
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3036
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1312
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    PID:4260
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1120
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2416
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4280
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3532
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2428
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2444
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5776
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4088
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:6088
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4660
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5284
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:716
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2000
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    PID:1900
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5072
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2840
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    PID:4156
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2352
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2084
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3412
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4932
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:932
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:3920
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2844
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4632
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:1428
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    PID:4616
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2824
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    - Modifies registry key
    PID:4172
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    PID:2288
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{37B8F9C7-03FB-3253-8781-2517C99D7C00} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4024
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /f
    3⤵
    - Modifies registry key
    PID:5176
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1572
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2500
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /f
    3⤵
    PID:5788
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3896
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4584
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    PID:460
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    PID:364
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    PID:5744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:1128
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
  2⤵
  PID:3004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k swprv
1⤵
PID:4716

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3112
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding A37D6065693EA9C10D61FB151E525619
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5328
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding A580DF8611CF1CC36FD1499948D63CCB
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AFD0E019290545E6575D06A1D143EE51
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3032
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1EFC1517C97A1730273A10BA30AF4A42
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2960
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 6709E94DC1653873CBAE63741251E7C9
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2220
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 666A924AC7120F481E2D9BD21159195F
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2356
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2B6C55F91BD996574261738E9A9F18C3
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4456
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0207966B0430A44F434B0945262D61C7
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C90E6F510755176DD261E69E56A51B94
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9CD5A65390837C2BA61F3F02AE756C44
  2⤵
  PID:4724

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:1408
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132834.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1096
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132834.log" -burn.unelevated BurnPipe.{34864D47-5A72-4F1E-9532-32F5A5E5BE91} {48AE4A5C-F8F3-4644-878D-82EAD5AA9E0C} 1096
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5552

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2948
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132838.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4452
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132838.log" -burn.unelevated BurnPipe.{00F4EAFA-7036-4A3E-9BC8-A81B4A8F81D8} {DFA660EE-CA4E-47EF-B8DD-D23FA0F219DA} 4452
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5632

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:5740
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132841.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4640
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132841.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:6088

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2432
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132843.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4148
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132843.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5aa982.rbs

Path C:\Config.Msi\e5aa982.rbs
Size 21KB
SHA256 a08e0739743a7e680e552c8e9b219798b913a3fb11abf1e4b340e5fe5b57e778
MD5 a18a0f8a212d07eb5bfa4229dcfd4dea
SHA1 66e41026d91c87dac35a086cd4dba3e2a7ed322c
SHA512 7f7329682a4d6a4298f748f8e7d877720782beaa30321e0acf3716a0cf852b2fbe1a3407ce0f365e46f522f157b210c80ddea1340b6568e1b0319c4c35bef05f
SSDEEP 384:jeRPWRhwe5esSOMX3Mq8KywUDNixbn4kl7gtckpB:jOeCe5erOMX3Mq8Kt8Nixbn4kl7gtckT
TLSH
T1B4A2EE03BA4092E3D8672B30DD6B1B257B76C7E99311839B04ECA1344F977C62F9658E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa993.rbs

Path C:\Config.Msi\e5aa993.rbs
Size 14KB
SHA256 567df24be7d0c246a24f86b59732815c6445291ccdc218b9f98d035d1293bcc5
MD5 f2cd55e7d50bd106afec48841e8fd774
SHA1 a3b84867debf56b3e333894113c76d29f868bcfb
SHA512 fb045359a0a3c3d4373fd28d356c240a5c6471db2e50cf5be316934669eefa20036250a444a41c43dc9461b30192cb6b9ed8c0fc1e5e62a10123861a00033c18
SSDEEP 96:jMNp48xNpM0l7ztH8RieDwYx12tH8RqeDwYCj71rR7c7QNpx1FNpLxcNpkFaxcTh:j3RCYbR6YYaqbzfCgPo6/Wsfl
TLSH
T1DC520003AB0596C3DDA62B30CA231B247B73C7EE9354835B21DDE1704E577862E9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa998.rbs

Path C:\Config.Msi\e5aa998.rbs
Size 22KB
SHA256 dab5d16d7a1ceef505200f45455e195df6032744a1fc5a4a6a3eb71c21e832f0
MD5 7019d56244d8ce23f12aba4629fa6c6d
SHA1 1946403efef0e2c4c942ff150bffa16935163204
SHA512 3ca936258cb6153c624e0f9571e399bfabaf404ae2acd0f9f60d01678a1c884eb907330874c9c2c0af0b0a1a9a1bd3204fe761c82e7671af110f52f966fe3652
SSDEEP 384:pHRORR7NUZUGz5YkrcZqbogvXDrlSPa6ZnGtySK7:pxOmy
TLSH
T18EA2CB026600D5E3D86B2B30EDA71B693B32D7D59354878700DDA0748EA73D72F6DA8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa9a9.rbs

Path C:\Config.Msi\e5aa9a9.rbs
Size 20KB
SHA256 7a35d2b51a852fb0a5926271be281e1cc475221c81f37e93dd2ef84ed51e9c9c
MD5 fb5cb483d92fc4f749f7529915b9dae9
SHA1 a5356193fdee2c9dfc7fecc099e3fc3a03f747cb
SHA512 d0439895859f5d2cfeca052e1c5b3e841e2c90fe6a65a97e7f979c843ff4d5b9b90961ba57f9a48533d7850a06b75e3d4aaf8bd2e57b69f2786f609ae8860975
SSDEEP 384:oIRcglRGgFfXMawmn28I1S9HXVZFbLQPOSAOjWQnkQhAzCFTft:oscgGifXMawmn28IA9HXVZFbkPOSAaWI
TLSH
T17AA2FE03A648A5D3E8B62B70DD670BA57B33CBE59361434B40DC94394F933C23E9968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa9ba.rbs

Path C:\Config.Msi\e5aa9ba.rbs
Size 17KB
SHA256 655f5031584d810c289a0325b258b21650610eff22902448aecc7e9ab467b91e
MD5 edde62b98fbe5a4e3a9364a2bd734858
SHA1 e2dbc8beb470b41589a1ae0db59954d7a2a87c01
SHA512 f2e34982f8afae1579f7a815609000c9aa0d7a0e659d765131ecb95cf069e926cb15cf0b36c35143d5a198f5c445bc9104f856e041845856a258847378f3f3f2
SSDEEP 96:xueRp55Rp/NPWT8RweDd11xQo8R4eDd11Cjtknz0yWcW/Rp0Q2RpVdzRp9OXw3Tb:oWR/1GRn1Hn4Xyin5f7e+nh18X0Jy
TLSH
T10482ED42AA4096D3E8662B70DD571B7037B7C7E5A344839B40DC92349F87BD22F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa9c1.rbs

Path C:\Config.Msi\e5aa9c1.rbs
Size 21KB
SHA256 2141629401de7e130e199094c310ee7a9f3558c41798a61635981590926173d3
MD5 340f5f469ec57084f19ceeed2bf65c86
SHA1 1cbc928843b6aa8432567aaed2db804f5e3f4879
SHA512 c40802971534962aa02f0c4c26c50488176087c88a68746c7518d45d8fbed8680a4014304964007f264250c74db493f80cc9a569a6e658dfd1792cda278a0b81
SSDEEP 384:EgRfGRAnAKxNAUhUC7xJjrMNYPzIbSfBSqVgAJWz05zkP:EUOwAKhkmO
TLSH
T1F8A21F43768089E3D86227B1DD671BA53B73D7D99350434B10ACD2388F633C72E5AA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa9d2.rbs

Path C:\Config.Msi\e5aa9d2.rbs
Size 20KB
SHA256 607923858f0286f5e20b50f29cc7b7524e9aef6b3d479353599d1689724ee04e
MD5 7653e1b7f0e2ba03284ddb38f19e03db
SHA1 affa4249a63040491a54e42ad6e3a9997ab13858
SHA512 d40d16c2bf636274b798dda628f0eb1884fe3710c3f66f98604ab83faa556c1e0c2d14b2d4a473a4d9a4b00ba80f178ea15d3973f473b17c1833c0209b972ae4
SSDEEP 192:EaRY1kRx15dXcFUADIc1f+W+y4+oAkgCleGZ7:EaRY6RxTeC81f/cq6eGZ7
TLSH
T10D92FB42AA84C9E3D8766B70CD631B653B76DBD5A350438B40DC90308F93BCA2F9D69D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa9e0.rbs

Path C:\Config.Msi\e5aa9e0.rbs
Size 31KB
SHA256 bddf7690c902c90caff53125edc7418e92b558b3f37810029332ecce0a508dc2
MD5 00fe62ebf49fbcf2cd95e36b9776a97c
SHA1 af5010e1e6cccc4fc691db1c74864a9fab8458ed
SHA512 1e1c3497b26964fababd7aa9c8a8b027e6fc66b293d4850d928636a2cb5f456214113e86a719fa34f8e73e452b3966341177da87669a0aa4e289eaf04b4c4bc6
SSDEEP 384:RW8N8NRneRlTu8iu84u8XcAlRTMV/ZawBV3yFgmkFRu+Ru2S:ROOdsWVvRIVxDe6FRu+RuJ
TLSH
T1A3E25402F64EDAD2ED283730CE872BA57BD3D3E6530E1A5B00CE91701B46BD94D5D26A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa9e4.rbs

Path C:\Config.Msi\e5aa9e4.rbs
Size 15KB
SHA256 b35cb5909dae1fd8a5b895428338995ba1e657098f0c72582d93ea37508dd089
MD5 5bcc4ff2f58ce5c1a67f6376eeb92090
SHA1 41a48ab0d98b4fac11313e35bb7a1611e08cd67f
SHA512 30868863c6b55ab9ab31c56dab4c098790d08760adee8d3514eb765600cb354488ef6cdf7aa2864040c6cc7dc8c997f41d6cea7443190481c3c01b5b19b01b68
SSDEEP 384:OFYRS3X27RRSmX2tR5JZpgBmQ7fpqPfdEFv:OmpN4W
TLSH
T10B6220426A1581E2D8672B30CA4B1BA83F66D7D5D319834B01CD96308F477CB7EDCA5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa9ec.rbs

Path C:\Config.Msi\e5aa9ec.rbs
Size 49KB
SHA256 bb2e2d58130e3ed35cbec5238beb49233c7cc500b5eb808600688eb0144a61da
MD5 53706f0abfb0fa3ce1b3153a7a22c1b2
SHA1 426ed29a17b83d6584cc0d96c707120de0268995
SHA512 a98ed6de277dbf49b2e5ae36f5c670011b50dccac86dae26d726deb6befcf9bf55030045b03129db02cba171a57844ed0e5aa5faac0b7de67ceed534e6bffa37
SSDEEP 768:LG9YWVQKRy2Rs2iOD0MMGrLxBg3JfWmCbuMmRzlV8zx50s:0J7iw
TLSH
T11B33EF027344E6D3E6652A30CD030BB57F3BC7A69312866B549DC1788FA77C62E89E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa10.rbf

Path C:\Config.Msi\e5aaa10.rbf
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

e5aaa17.rbs

Path C:\Config.Msi\e5aaa17.rbs
Size 31KB
SHA256 31ea4d6673fca00edac755f6b5098d6c8ceb1386fb2ddd00c8d44b266978e7da
MD5 57bef723883037c2aa33a5a0b5130bbd
SHA1 a5e5c975b4bd941e3e93ef39b3ad5ef96f24ccf6
SHA512 34432a25820ba32b954b468ea9061d0e85696b56f9d9e7526cd37e31000b2bec7f878301eacffacbe55b9c6e5fe4f69f94a36ef1408e857ffdacd3f62b9fecc0
SSDEEP 768:CiNnR0EYuxy1SQBDBsAE6HRzY1WY3BYBYFY7YYYpYclxlQrnr:k1Sk
TLSH
T109E28207F316E6D2E9493F74C5032B6CBB97D7A6830E064F44DDC8A00E66BC66A5538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa1b.rbs

Path C:\Config.Msi\e5aaa1b.rbs
Size 52KB
SHA256 642ab2df5d665abeac3b9904f7985484bc3fc67e585b53e9352f02b2c0cf376a
MD5 b510a5e58409abeee175e6f9b871308c
SHA1 9376759f88d1dae5ad7fe4e5d4ee0c3c87eaceb6
SHA512 31bba8b2d23b2b236248710342cd346fbc7c8aa2e0c9e5eea90f87ef80d3df05521037dbbe5fba1078626c37061b16ef36a3287d0badb6a257c650c646e38fed
SSDEEP 384:+lUXRVLRat9I69m4Z9qjSZvPrwtFpCndsTfjUEulJGw8fR0KO1R0xJ9ZR0OBR0D+:+4X6t9qM7k6Ef32b7Cse
TLSH
T1EF3372023680D0D2D52927B2F82B0B94BB36DBA65721039F85DDD53C9E673C66E8CE4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa51.rbs

Path C:\Config.Msi\e5aaa51.rbs
Size 41KB
SHA256 cf9e4716b5d05b7d95685d9a1a42ad21495cbc8d1b6848495adae71f337ceb8d
MD5 a4f069b2584c35440af5141114c2d957
SHA1 6ec318a360958463bb2020705e803f53ba474ab3
SHA512 82f9da26f304653cc5987ce9f8d64f348df2522905625ab0cd3e5dc8de27ac67ad5734a4e3bf447ede6d5b226c431afbfa637d8c7b92377a64eb2d1ae53a7b7b
SSDEEP 768:DQyMuCg21kTx9/DoflxL1JcEYAwNmWNjINJNZj45:UyMuCg21kTx9/DoflxL1JcEYDag
TLSH
T1561352027900C0C3E5662BF1EC2F17847376D6E79B21479F85CEA5349E873CA5E89E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa57.rbs

Path C:\Config.Msi\e5aaa57.rbs
Size 3KB
SHA256 b5ff9806e44deeade8fe3dff4545763f77f6b31784b231838e01acd8f74b62a3
MD5 237f6f7f1878bb92365737d2829c3b96
SHA1 61a89f85fb2b2a1bd5e24ad206b3b87c4a3c74d0
SHA512 f2ce1dab9df70a23a7f91f99c69214d411be7ef9feeb9e5c87bdff4f534ad91f2275c85bcbec0444b562a6b79a8941674164688326c175f10cc7833ff88b4a37
TLSH
T11D71C142DA44C2D6ECA96B30CD471B2037B3D3DAC364838715CC91708E47BD6AFEA58A
MD5 SHA1 SHA512 TLSH

Submit Download

e5aaa5a.rbs

Path C:\Config.Msi\e5aaa5a.rbs
Size 3KB
SHA256 efaf94d59c482c7a1a49d7941e2d4718ec2c3353ce754a455c916b223a929bb4
MD5 cd18bb8808978a2ad327d4caed193b17
SHA1 caf9134e24cea2faee9ff141b90b8f755d385a53
SHA512 ed50ee893093e25305aa91f7c7c1f627256b87f20a8a57007e8f8e13c5fc4c45ba32ca4d6219d6c57727f1eafec6f5643972c21f399c2cc7ab97c01bf70190f8
TLSH
T10C71AB03954893D6DCE6BB30CA571B143777D6DAD7648387048C92700E477DAAFEA28A
MD5 SHA1 SHA512 TLSH

Submit Download

e5aaa5e.rbs

Path C:\Config.Msi\e5aaa5e.rbs
Size 14KB
SHA256 cb19780076dfbdf2f6b168dda0a70a15ce088c572923a6d92590e07d183bb844
MD5 3b11c43051fae5a66816370a6f5036f9
SHA1 458927feaee7793fb4433b05425523ea98f4a51c
SHA512 6c306c2d36968601cb4fe1f96a742d247570d98ef278676311550863e15ac6c9d4f50129aae7f50435b66135d67104ed24bc5dba815f658930ee7b6f153b8b80
SSDEEP 192:WyJXuj2IYcw/0FBC/1NlAkI4NlAkJnFEXENNep6F:Wytuj2IYcwVNmoNmOh
TLSH
T1E762F142A60082D3E8AB6B74DE5727143BB5D3DBD391638B08CD91304F837CA5F9969E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa63.rbs

Path C:\Config.Msi\e5aaa63.rbs
Size 21KB
SHA256 283d686ddb2d43c8df1d5c439d9ee85c40c9942fe036333da2231a583ec2dde9
MD5 8b9026abcd66a0539ca37bdd1eb3b2b0
SHA1 efda2510f770b2ca5eeee799ca9a21aeda96b9cd
SHA512 be45281d5fab1275307e95f4be6625e84782d47017d7ccdc8c37a156079cb7dc96304c18f444d1108b3bb51deab6d68f8c9cd51b736e80fb1acd4de082752fb1
SSDEEP 384:XMT8MgXEtmrnb0MM0IE+AfCuS588UkRqNu4NuB5XDcpq:XMT8MgXEtmrnb0MM0IcNrNeF
TLSH
T1A2A2EE42A640D6C3D8A76B30DE5B1B653735C3DAA7A4534B01CCD0345FD33CA6F9AA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa68.rbs

Path C:\Config.Msi\e5aaa68.rbs
Size 18KB
SHA256 d06f6ec22502cf26e503c1c459dac73f24b7b6d2480a841673ab5734387b25f2
MD5 81303da0ae6b6b0c47a8d2cf722015f4
SHA1 1a7ef5303ed4786a18c540f5edb2fe2cd6f7bb41
SHA512 da3d76b9b25be20daf4024d5ffaf43d8947894a1a50a161138dd946809736250b35022e4f73a9c0d83eea2a6028fb22832b35ddd4c4d0dfc1a29d2c670811c35
SSDEEP 192:X9DAoBHRq+M3NinQv7XZDtY1eCd2NofUIVNofUg03ETLNfHOp+:XxAoBHRqF3NinQv7J+YNofVNof7X
TLSH
T16F92EB416A40C2A3E9A63B70CD5B1B1937B6D3DAD7A1534B41CC80748E837CA6FDE58B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa6d.rbs

Path C:\Config.Msi\e5aaa6d.rbs
Size 21KB
SHA256 67396fa10fe2b9dd52a7986d950c96213575d88d0aa3e236295e4675c9550049
MD5 07a12c7107e424c14dc0311ea2bd9112
SHA1 eb17200ac56af6b4c280b48c311e5e6993e88b5b
SHA512 910bdf1898ffc79dbfbca02689b4d0c326bd7cb54688f68e32009405727aafcce5933fa0596a61c0e66bb703559df50a49cc35dab791ad011289868948dcd276
SSDEEP 384:QT6tFYQxkA+pAv9jH4ryInsalckU72eC6PZj4NZMNZ+2Y2sLH:QT6tFYQxkA+pAv9jayIiZUNCNM2YXLH
TLSH
T1CBA2EC017A00D296E4AB2730CD971B287776C3D99361D78B80CDE1348F937D66EED68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa7c.rbs

Path C:\Config.Msi\e5aaa7c.rbs
Size 41KB
SHA256 1dc0e9d4d0b23681751a6d91a2c8e30cdb0374c4979574acab3be7dcac405fb3
MD5 620005ec18c131b83c9724c600c15fe1
SHA1 da94f6bb51fcd11974a092345e5762c3122de30c
SHA512 358b60be0329b1040a6f5d9e974a802d0b06c9764bdc55338abe2e1571db6b710e159b090692d51d43accc39943e7aaae82ea68cc8848d96094be784928fcf07
SSDEEP 768:qBW4uxO+YgpiqeHs0wgdKNk5EYlDTN8NUg:/4dg
TLSH
T1C513EF426600D2C3EAA61A30CE071B757B7AC2E6D715976F14CED0704FC3BC92E99B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa82.rbs

Path C:\Config.Msi\e5aaa82.rbs
Size 3KB
SHA256 e888f0bf44c55803d13df837100a213fae41850a24b8faac922df490a557cac9
MD5 0ab48996a12c30d264c1386cc68b6296
SHA1 c97b9721f88007a54fd16a7a7f4df44ffdb65338
SHA512 d901c4b65922c14185c5986caf5070d646556126aefbd2f262bc042bcd1da3ac13eb6eb8ed0c5b2bfccb1795633909b4b2d7db9a7d5da320e9c39dc0f8c6b691
TLSH
T1FD71A9039904D2C2EDE63BB0D9571B2537B3C7EA8790938B11CC91704E47BC6AEDA24A
MD5 SHA1 SHA512 TLSH

Submit Download

e5aaa85.rbs

Path C:\Config.Msi\e5aaa85.rbs
Size 3KB
SHA256 7244917776bcd5ca9441077244930a68e720a4a764721446df22f4040a6210cb
MD5 fc4007139b12be84f5c0b7eb9f9cab95
SHA1 d29021cb35ca2b8b432a31c472102e059d7cc8ff
SHA512 48fec10d32e5a66bdb73975d1832669c3e15ba8d0e6946a2cd088fd4e0a61af32767b2f92ff5c9b2b530f678a44437a30ae77bf3f9d2b61b70b874f0a9e0c39e
TLSH
T10771C043994492D2DCA62B70CA270B6837B7DBDE9750438B458CC1740E877C6AEDB28B
MD5 SHA1 SHA512 TLSH

Submit Download

e5aaa89.rbs

Path C:\Config.Msi\e5aaa89.rbs
Size 15KB
SHA256 6d9f42ad6383605da1b435132d23403a0f898a56477cf7b9b9f8e8d18637c387
MD5 c4400d62123cf5993a3917c22f6c9383
SHA1 950d797af99b696c5b62fd013d34fb73acc5b44a
SHA512 15fe1d9dfc55c201fe6e4421a50964f551cdc0678f1be4e4ecde1c468c970074b1d0efe82a7c9e4f3e59196198c81a659d92986d14f7d73a219709aaf15886f8
SSDEEP 192:GrSKxlR5UCy1NCAkIgNCAkyH/EnwNWepFh:GrnGNjwNjRH
TLSH
T13A621F02A60095D3ECA62B34CA971B583772D3E6D354934F04ECE5749E87BC61F9D28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa91.rbs

Path C:\Config.Msi\e5aaa91.rbs
Size 20KB
SHA256 c553ce3af922eef66880804f64d77592310397aecd5c24821a556c4828f148d2
MD5 abde6af97935838856037236cb6f20ec
SHA1 8088094608f9fb513c95cff75916a232e60edcd0
SHA512 70fc2e2211b9b48cb1caf9be1ce798b3f2d2320ed75a300b09a26ca5a9ce6b15098a1ae16b69cb93451c47f0a49058613258f7db208f901b61e9f96646f48091
SSDEEP 192:9YUU92K2jY0E1iKCq3wzR5KCf1N6AkIuN6Ak60W41E5kCT4b6epRX:9YdIK2jY0E1iKCq3w/LN7+N7SYT4bZ
TLSH
T17C92DB427A00C683E8A76B70CD6B27283772D7EAD751578B01CDD0304E937C66F9A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaa96.rbs

Path C:\Config.Msi\e5aaa96.rbs
Size 19KB
SHA256 89a65c9556545372e5418b0c027d3f352b3ab8a54ef5e711e4c1b353aaf105c6
MD5 397efab6bcc726abb66a27dc960d7880
SHA1 f0cd749a2db2740cbd7b579302e710cfd4de2edc
SHA512 6505f489abc282c00ecc9155e0bee2b3d9f47b92ba8850466bb98f26a9fed9f0348a8768be5d9163364a9e14edeb04d02771e7e6ccac688f09901b7d8240054b
SSDEEP 192:4OYR3IR0CL2NvUIENvUSyrjnyEmqUxOpw:4OYR3lNvENvoIr
TLSH
T17C92DB436A00C5E3E8AB6B71CE5B0B163B72D7E6C754634B44DCD0304F937CA6E9968A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aaaa1.rbs

Path C:\Config.Msi\e5aaaa1.rbs
Size 20KB
SHA256 97e368e3424aad02925ae2a1e24571e39a987bb99dedeb1901371fa065d4c602
MD5 a8688b435dc37836196fcff40bea6666
SHA1 d90e5f846052c70b3e10b511048e7f6eea583afd
SHA512 9a55cbcff327bfd4848afa7cd7fbf15d341ba2f845fff8b94a5b9c28b8c2ea78e59f1a3af99790af673bd5a7fb89b6941139feb929ecc7bb011c582de13eaa0f
SSDEEP 192:ahmBtwUk0Ve2SD4QsUh+u6RJCT2NoUIlNoU5uDhLW5LsUErLrS7aOpsH:ahSVk0Ve2SD4QsUh+u8NolNohlKQfS7G
TLSH
T16F92AA427A00DA92D8B62B30CD971B693372D3DAD751534B01DCD1744F837CAAF9A68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\state.rsm
Size 584B
SHA256 40f546ddca594aab22b8a1153d71c478fcc65d0668c834afbfc3d13d7edc4f18
MD5 038d50ac0375cd9f81fca57810b0184d
SHA1 7b4a3051f6d321c7ac6652751b45d3d870c381d2
SHA512 47c4d375437099c75f0b70665a30af949c4900db1e3b6ae9d863346fc1f11946eabcd294fa69b191e9cf9440174b59c28fea45373d372045afa73be2a7e74cc3
TLSH
T1BAF0EC654FF2501DE2B3AA7178F50A56596BB8036931C52E0182328BDF317C0ED68B56
MD5 SHA1 SHA512 TLSH

Submit Download

vc_red.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi
Size 232KB
SHA256 72a46f29c780949c1151efadd899806ee192b6fb4a87a9646d638df95f3a0bbf
MD5 824f1f188704d3de77660d90fea6b136
SHA1 9bcad1428defece9f2ceaf647d9571ca41b3f40e
SHA512 0e67e74d11d9423e5b8c95f35e66f173d051e5863466837c3f9a4cc2064d4e4e3e1213437c29374abe6a888f48280ac45da9befb8e90ee3bf111f695916cc972
SSDEEP 3072:55Sa1UNmUq59Zh3pe8lwAx9JHHpXhvq5J38J:55Sa2qr/HHpxva
TLSH
T1E7344C11B552C133D8853332406FDFA12AAC6EE79B52C58721E932DC6EB17D4D3792CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Installer.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd
Size 28KB
SHA256 2524a822d83eb2c6fd94cb986586a8f96486f3ce18041ac559475deefef406b6
MD5 952d1684d29f0c3351adaea8eb0192ff
SHA1 ada48c2992be5e70ce3ef81bc1f9b5fc95708a4f
SHA512 1f3a07703d29da1cc9cf2933659d881f064008fa556d92d90b40169fd68a954ea15e0352ac5e6e6cc7e2cb7908e183ddb15ce0719b0a27d67361e05a34afe6bf
SSDEEP 768:ZaSz7KzGs+PFJE7ynC0u5Qn3RAL9iLbO0inwJz3/o9L/Y7xoXyEMdBE2SEAgEEc4:yL9iO0inwJz3/o9L/Y7xoXyEMdBE2SEv
TLSH
T1ADD292187D8C523579F0C3B6E33592C2FB6ED5A25B30E68C7CA6C8A0746B116907E3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filever.vbs

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\filever.vbs
Size 115B
SHA256 d4964554ef1fe0093b7c66e1285b1598bd9573df0b99f9a7e222d1fee448f860
MD5 c1aaed4e1791179d9cbcaccd4b544793
SHA1 71e365d700bcd1afbfb7a030692d891cce18eedb
SHA512 7c56da34bd514181ead79020547229a3fd01b3629807ff7acccaa2ab5ee747c58645c9ea1113ca7fa58b9d78de9f595010364c8abd2201eea48563fac303e11b
TLSH
T131B092006803C4A60B43069104AACA4BC7E992A53036E2001AD2C9C952077B819290B2
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\amd64_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_9caaa3a5ed56b92c\ucrtbase.dll
Size 971KB
SHA256 24968e69daf49f58e812ada3e4cb24a66d6fb9ef14fc211538dd992b08ed1c3b
MD5 1eb17f650462eea820f4cd727d2d3ab1
SHA1 688f59160589ffa293502bffcd5c0e62e1993903
SHA512 4b2fd6f202d2c697d10e0a2751ec05128071c7a3f1296c9f41fdbf07b334d8eb48dad674d91150966e0ea925c8e2aeceff904bb3d055989de2e1f94dd7d4bf18
SSDEEP 24576:JdX8vuNxBoVnCBuwJBNMsSLvZCRX3fp8di8DmxvSZX0ypnB/:/+quw5pKZC9B8BB/
TLSH
T1AB259E79FB5C09AAC57BE07CC95B160AE5B63402437086CB03E64BB97E2BBD91637311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\ucrt\x86_microsoft-windows-ucrt_31bf3856ad364e35_6.3.9600.18144_none_408c082234f947f6\ucrtbase.dll
Size 900KB
SHA256 a134a1d4e9143bce04a4bbefe4f7ee5ad677da1913c1186e021623df01ba28bf
MD5 3df1d7da8c1493a5a00c0474323fef20
SHA1 f771c2f2cc1b0fc8534c7670f1633e8316f62092
SHA512 fde8e6a06b13ebc64e42e09583e1466d32812b907274fdae8a5e04ee27f108aa311646e62b65aec30db5a9c150fdfe478b1586a7c413101377de50899af36582
SSDEEP 24576:mAqW/e5NMe7KtlQzn4pz+xJlEIngFmcvIZPoy4zkkq:r/efF54prq
TLSH
T168156A617885C171C8FA71F81AAEB232057EB5944F70A8C337D40FFEE5651E02A3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcrun.msi

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vcrun.msi
Size 36KB
SHA256 15684d42d6107225e93cba6c6a3311a7a86d4b515027da263fcd949d818532f2
MD5 02a7a8f705fb831559baac094a0b4269
SHA1 d47da0b6572514af57c3246059a4039df059f72c
SHA512 a68108d6a35a91750489a6c4a599187c3af5eab390744f3b56036a092117a6befb5cae9df56284ad49bf97aa99ae3bc6c1bc31a52a00e89e26706ab25ba7c400
SSDEEP 384:oFSHcrEiy9UJ893M5BCnoXLSy5vd6ey3M5BC0pb0dooB:4bymJKMDCZeWMDCa
TLSH
T1BDF2D70E76005336C64103735A6F97E81F39AC854F26062679AAF35C3FB28E493BADD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Office.Tools.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.Office.Tools.v9.0.dll
Size 101KB
SHA256 130dc7a800def28ef85739ad62ce8168fa1db01a6d6138575b51148d7d56a28a
MD5 ce18bc86e63f3192719ce0d7f286a130
SHA1 86a935fbd2fd9f5b39307ef986146cb2ff2adc33
SHA512 236bf295e0551ba64d743833ffc5c1d1b5b4915c9df5ccf3300013c765befb37808651087c388962e2f7bda0a143a406f923f408a24373cee9e6cda49aae5b73
SSDEEP 1536:7Jr/e6TLw8PW/lTqUJBS0zxRiY+Xmh8GTEEFBtGQglqKA016kyBekazo:7Ji6vPUL7zxwXmh8Gf99XZ7Bwk
TLSH
T125A3F81483FC4F61E6F71B742DF6A0814A72FA625EA2DB1F102D410D1C63B949A62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Size 27KB
SHA256 bd7eca9f684ac4bfa0c4d63dae690c861fdf9903686c693dd743e0a8728a76c1
MD5 d0958d7bb727740c9d9952b1805163fd
SHA1 a3b18971219311fd6a7e5f2be14979c3777d4d68
SHA512 138bd86e0b1f0b32ba453475e1fa81e11e9d4300db197b58301a5d478b3213079dc30c700f52220ff957fef10c4c85d1230308d83cf7560547b475fb346e1460
SSDEEP 384:Sp0wdaXOa1FnKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81dWIY83gWQsLBiHR1:O0Ka+q+6rqnDPOyBeRmoQ9zpI
TLSH
T139D25628D3F85312E2B38BB099F5C447AD76B953AE34C7AC2596534D0C227849963B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Size 31KB
SHA256 b7b00307eb0c500808f33f97a6691080a62ad6c35702d9e803037a1897d1530c
MD5 55c9882d7612e7e8b69fa5920410be3d
SHA1 9517d22cc6d9c7f9b64d2c8152849a9075027c91
SHA512 a6fc94a8a0d6a690493819efd463b5263871346a94e7a1caa379871dd1fdc6527311b02eec70c5b49406aec53bf4e2d04d14c592754bdd3f6a251e64f9e2b024
SSDEEP 384:F52RrrOcCdqEGSGEg67KGhJSxUCR1rgCPKabK8tBX5PKytZ+cZhP8W4XYWcsLBiM:3urKjgEnGEFiJrvPAOyBeF29zKk
TLSH
T1A8E2962893F81312F2F35B70ADF5C483A937BA03AE35D76D2586174D08667849963B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Size 137KB
SHA256 1706d0a3ad2696392958ca78d63822b0fd1947c9b10021beb7fe14db5bf288fe
MD5 b5c91699e57a807b2143cced62e70e77
SHA1 067f80a3c6b16ff9c4acff06099393084b6368ff
SHA512 d843235998b04d8f857239b31b5866c5328de3455b330f57be5f61acccdaadfa174231cbc57eb07f8cc5f7f3d8ba598fa0399fd8d13759d3c428d31a07265003
SSDEEP 3072:nEmV8EKUaX1IrJeE+6pwluGCulHxTqo+UeYBs+:nEm5azUaxWIN
TLSH
T120D33B11B7FC371AF2FB0B79A9F96001C97ABC556A26D78D1851424E04B6FC08A32B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Size 79KB
SHA256 6979c9cfa4fb9590304d632ef1e03495ac83dc3f4af8e5f8b89de1b474ec1df8
MD5 2c100809815e27163493ea5e81010d1c
SHA1 01ee717e6f9d6c3d574ffe82c1cff3cf2467419a
SHA512 c22de3606e5cd1a9ac2e1cbca3c156831d5cbb99a50e4ae9f34df7d93b4d9093447d62b3fdc031be84a6c7adf16e23f7b5b44ba4eddf21bca13a26704d8a6b63
SSDEEP 1536:QdbojRaLEJ2tF0Hdlyw7GL1w1IcT7TXLqdqCOHp2gXmyBejjzQka:yYR63P8dlNGu1IcT7TXLqngXNBCjkka
TLSH
T1F983391193B88327C6FE43B464F0A8125FB9F253BEA6E71D09C5A39A48537C18D5272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Program Files(64)\Microsoft Visual Studio 10.0\Common Files\Microsoft Shared\VSTO\9.0\GAC\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Size 85KB
SHA256 0bc784fb37530ce516be9f28fb84419e17056c522c94e167352921f4f9a93889
MD5 33247411fefa060b5f86eecd66b95078
SHA1 74784f9e3da6f1579a22f5723d46c5de50add359
SHA512 c1ad16c956cde61fee693b1483905ab6711841750bab35848a1e7261165f37273d8380daf8e6f4d2d35d520ec52fa943938f3ae7ea056a112bc9200d7e49c136
SSDEEP 1536:kkrEteCiTny7jWHfpSEZRwsexZG0YUBXfqiGi79sShdX+yBeS2TzR:kk3gCbzexZG0YUBXfqidDhdX1B+Tl
TLSH
T18D835B27A3E85713D7F74630A8F09A03AA71FAC37565D39F2046672908AB3D44E32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\Win\Microsoft.NET\Framework64\URTInstallPath_GAC\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
Size 44KB
SHA256 75e3aba38517f6396aeb31653a92ef8942eba6e701007f6cf3af95f0f9c47785
MD5 c2e0ecbe64eb072ed008257142315526
SHA1 3d732f858fe67bae8f369ef19ef282e11a83f656
SHA512 5e0d2a7484e63254e455d6e9da44f79533638607e41d7c4eaf77529f6dee50904a675d8695a8e5c0ac835e813f2a7e11e7b1e0cfdb82553edf653451fe816203
SSDEEP 768:Tc1JB9Xaefxf2ZquXoQGaVP6rqnig3MbvyBeHO7Ex9zQB:A1JHXtp+ZquHVVigczyBeHljzQB
TLSH
T17013D72493F80313E6F757B099F1E443AA777953AE29DB9D1099574D0812BC1CA22F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260910132838.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132838.log
Size 7KB
SHA256 c353a74d79551c17d4c9b1a8f4cc6a8fa80b97e737a41b50d1d1385cd2ffb23f
MD5 9c99747c7bcffb83211b02c5c7824a1e
SHA1 44ab79483ae798c0fe2ce7db8a24b46f7c2536c0
SHA512 de742b2a52683915dab2124b61f1eaa4903ee94f49187fd4d8488748d6f10045a07baec508b9e2397e05ec6272b8f616fb9f191b7fdfeabb6134c66aaeb76539
SSDEEP 96:kCiMbtQyUVpbZbxbkbDrDrz7AvqjFVEqqVkVBNA6AeV4Vz/hfm7bWbdIbytb4WDG:r0ld8//ngSEZcolKYJmsjGPh6A
TLSH
T1AAE13246BDFD529839D4E1AADCA09FDCE96331075A42BAF0AF6642984346E5CCF79300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260910132838_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132838_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 0cff15a2fe4a4f6fe11c04ea19895f65300c2aae0882de971d2bfd8272c39ac8
MD5 1deed38da0f9ac3d009e4849f78ee6d1
SHA1 112b1bb0652e0d9d13567118910779d2cc701dfa
SHA512 ad0434868317f292332b379645710fde1001df0a9534915a0e2121f1443a46fe1a9172fc7c88c6efc4c112e0ac5a172f2918cfa54694b0ae2c903fd5af85e216
TLSH
T1A14195562AD90854B1BB564BDEF3C1521B33BCD7A834CF4C23C98319076BD0A686C7BA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260910132843.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132843.log
Size 14KB
SHA256 87bbcfe93ca7f1219c86a072098bd0893b129e31a94e4adf074b2360b617b05d
MD5 9bfbcdb43fe98d3c8e45489983a08c51
SHA1 2892c1f42efa6cc5f8419735740003dabdd34c13
SHA512 ad3d49b2f1ec8edda662024569c824922f9ca92c939b30c46c3ea867f77fd4e1d49035738ce710d690b2756f601633bdb62c0644728cadc76f6acbaede181ea7
SSDEEP 192:2cH3nD1f1d1a1C1p1X181Q0qfQ5CeT8eOpN8U4si70:2c370qfIUpN83sg0
TLSH
T11562349B3BF7A12D25D085ACD8514B5CC71FB20B3A30F8E4676A46CD124496CCBEE58D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260910132843_000_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132843_000_vcRuntimeAdditional_x64.log
Size 1KB
SHA256 4028d557ce80b0c80662c6740a571d70ae7c94e501c0e4e33002422abbe73cab
MD5 7c0682c6e8bc83252f68ddaa77f39958
SHA1 1bffe82e92fc2ca96719dd50a1df58c1e5696788
SHA512 c0c989464c6b8fcf1b0d483897f6cb5fcc2be0f1c11540cd9dd8dfe3623db008c8691960b8c6ade29f677492eec47f809a6faf9888ebceac9d9ccc77457f5363
TLSH
T19741D8651ADD0805B1B75657DEF3D0916B33BCC3A834CF4C23858129066BD06A9BC7AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260910132843_001_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910132843_001_vcRuntimeMinimum_x64.log
Size 3KB
SHA256 3b7c0cc8a337911a75e2e2132adfb30346242c489b5b4757ee7b82a753582ed9
MD5 0bbc5c4c5163dac4c71e92159b4e1014
SHA1 45f8e992f26e74c5e570a311da2bce00fed4e8cd
SHA512 0129ef13850ffd41e694f9237993ad01825d18d2d1f63f8b90b019c6c5430439554295cb9114198f5a596a6dac8a4119f2c8288b510090fbbeb47ebfa018af61
TLSH
T1A151FD151BD84C05A2B69657EEB3C0516B33BDD36C38DB4C23868219469FC0668ACBEE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260910132834.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132834.log
Size 7KB
SHA256 c929fc28dc765f7eb6d334404a7e7242e9561a8648b57a8cb4348d7c8abee5e9
MD5 f366b14ab596b00cac238440c1aa76cc
SHA1 721aae182d50f87850f50912f306db51cb348ac5
SHA512 67f388667d05c5255e0d0742170c08cfbe1750e4fb262cf7c58976538290aa240f106d9674a298d7ba17cfd5574a49b4cf6c265317c552b2821b3ae6ef48feb6
SSDEEP 96:EC3b3bvb3bSb9H8FeL7hNWcj6b9bFb0DWzssbUbhPCSbgJ:dLDLy9HGx5PsEMh98
TLSH
T10FE143523EF935942DD2F2BFD8A0A78CDD57714F2A40BBF07B9681484502AECAFDA540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260910132834_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132834_000_vcRuntimeAdditional_x86.log
Size 1KB
SHA256 ed9803e8e8f9f2c4984d8d1c58a613302ec374b2bb2f472ee1d74fd79876deb6
MD5 5d74ffddfad8b2b265181fef49c4145e
SHA1 e7246ae57000d2b7bb128616519591e4ba1ff590
SHA512 1798c8f3e380768d506602d66f3489241085cfe09c8dcbb8052004ec48455b9470f98f33d7fa82943fed92c9d69ff7ed2adec260c43c840f92d63ee7436240fd
TLSH
T1C041F2561AE90815B1F29647EEF3C0125E33BCC3A938CF5C2289825A067FD45687C7EE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260910132834_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132834_001_vcRuntimeMinimum_x86.log
Size 1KB
SHA256 a419a22a0d65353005626607b8ea6d5c777341519e8cb3e491d224c7a826d970
MD5 15ec32f57c3b3b6ba5b9ce2045b9bec3
SHA1 7cefaba2571d088f7b96812bb06220fba4eba0db
SHA512 51aef781d95eee55ad89ce74668df2ab15979079cb8dded4b9930eae9527be209c0ed1ae78e9e94519bf29661dfce7f5a9e654e411901298f166f0b48957c588
TLSH
T17F41D2651AE90809B1F29647DFF3C1521E33BCD7A934CF5D2288831A067FD4568BC7AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260910132841.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132841.log
Size 13KB
SHA256 48329212f8f79d52214148938753d21a03dac63a883262ba64fef77f74b3dfa6
MD5 54265330ee6630d8095d0ef1cc5c356f
SHA1 0c996c95f1c5b82cd27b290557ae3e170b5551a7
SHA512 5ace4830fa11de9dcef92a38e375ad4c717e36756c6fa6caedcede35f129e9eae5c9ee42a759b94a8b5cec95182009606d3c15e3e186f09e66331a1e28eb847e
SSDEEP 192:SLkni1i1Y1H1/1k1K1R1l7rW5zqv9nmoentV7c:SgS7rW4moetV7c
TLSH
T1AD5243C339BBA33C3CD0C591E51B9B6FCB1B72997940E9F05B1823595146D6CCBEA182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_x86_20260910132841_000_vcRuntimeAdditional_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132841_000_vcRuntimeAdditional_x86.log
Size 3KB
SHA256 68f18e1e0ed2c67a02f43f05af2685916bfa828761e64c70ca2d73a336841107
MD5 d13ab824f0535de4ac9c898e9b4f568d
SHA1 421df6ae1fc489bb6909a7eacbe5aed1df51ddde
SHA512 90d0a79a2b68dc91050e3aaf99b1a2810aabdeb682f489b6a5909a6f15e7f6b11c2c79ee20f5714a478cf619a12f2805f89c1ec871bc1bb94604b9637bac6bc2
TLSH
T1F451BD2A5ED50C05A1B65A07EDF3C4626A73BDD36834CF4C23C4831A469FD06697C7AA
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_x86_20260910132841_001_vcRuntimeMinimum_x86.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910132841_001_vcRuntimeMinimum_x86.log
Size 3KB
SHA256 bfd13e36451f112584f877cafb8da842b9eaa7f54bd967a211601ba16de22a62
MD5 088978bc396d6b4c00a0f58b7c7e961f
SHA1 72a7b848efb522302663a486114ea6f104d961d3
SHA512 9b46843a209be248ffcdeacad60f19b301a884639cc5df55d3f4d931d20e4f3e0de4deb624c69c4337fa7b4fc0d62564e5a72299b61f0e7682e7630096afd562
TLSH
T12751C95A1EE80C05B1B29A07DEF3C4535A33BDC359348B4C33C9831946ABD0668BD7AA
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 984B
SHA256 62248ef42618154e8527372789879f3448709017b63993ee75d1776c7a9c8216
MD5 5a83a0d789ed6f02421d44bdccd87cd3
SHA1 152fbeffaeac96dea12cdffc8b55e76502f4358a
SHA512 c5cb0eebecfdfe4bde5144155e3f4fde77b468e674d3f3eb22a9c1a1e8a4dc208701e4a88515dfcff0d794e68e7f0ae083bc49ed2fdf652d390d1d16cca28886
TLSH
T17211D69255244152B9B321000B2749612FB59F2A31D7CA1A45C9D9A3772BFCFC4AD38F
MD5 SHA1 SHA512 TLSH

Submit Download

msi.txt

Path C:\Users\Admin\AppData\Local\Temp\msi.txt
Size 444B
SHA256 f5533eaab75ce285af93111f1602b45c7874c6c4eff3161aefca592e8d1d42ec
MD5 058ee11acbce78348c14401f6d90b0be
SHA1 b8f5977a266eda796b9efbb2bd82cfc241df801d
SHA512 6ada4b2ab808d75a64156a81f1a413f907052bb6ef8025fa781723cae72404dce88a1bf33dde0f645fa0ad4a571fdf6f365b769080cbadb72dfa00c8503bf845
TLSH
T171F0A74245304015FBB161010B5F49083FB8976B21D78B0556CDE580323B9CBC49E59F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 492B
SHA256 850f34d3cb54a7131a564bcedb84bcbcdde89c2ae214dcedf1eb794465ebd3f4
MD5 826ab855bf3d4cfbe442e5c29341c742
SHA1 0f76eaef902a256221ca8d309b46e480113669b9
SHA512 d053526e1ec45b6667699689e80ff30237a860dfa35bfdbef2885d8c525e47b3886fa17e3ae2b35e69601305ef450ccea60dc85e6023cf0ea3e20777a26ddb02
TLSH
T1D0F0E28696214016FAF322100B1B49553BB5DA2731E6CB0940C8D9A37627ACF84AD29F
MD5 SHA1 SHA512 TLSH

Submit Download

wix.txt

Path C:\Users\Admin\AppData\Local\Temp\wix.txt
Size 738B
SHA256 08b2f5d869674d08782ea53811975a6cc1d67da024fbe30f66f3c5b8ef5a831e
MD5 89d42ed52b434f87f3408bf635d31183
SHA1 152a56d81427313371addead21536d631fc8c7fb
SHA512 392c0c0b574b88b790a35dc4c295723f14e5a02b0fb8e8705ae767131312fc9aee7fa41411f808a35c6408b8932b8d920020092f9ac518542da0fa5d30d356c0
TLSH
T13A01F58656214017FAB322100A2B49642FB99B2731D7CB0A11CCE9937617ACFC4AC29F
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Size 126KB
SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
MD5 d7bf29763354eda154aad637017b5483
SHA1 dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA512 1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
SSDEEP 3072:NiPaAuXlx9XuCoy57617IM6a9y3+7ZWMvd:iFEf9+t57IMld
TLSH
T1B6C37C5136F8C136F2E62576551AC3715D3AB9344DE188CF6F825A6A1E312E2EF3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\thm.xml
Size 5KB
SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
MD5 0056f10a42638ea8b4befc614741ddd6
SHA1 61d488cfbea063e028a947cb1610ee372d873c9f
SHA512 5764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
SSDEEP 96:wHdQG+3VzHfz96zYFJKFBiUxn7s82rf3nswO:wHAz8
TLSH
T193C179B546DDB801C133EB1166F231D27F126972C0C86E99F94C3AFA4FE1150A87B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Users\Admin\AppData\Local\Temp\{61087a79-ac85-455c-934d-1fa22cc64f36}\.ba1\wixstdba.dll
Size 117KB
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
SSDEEP 1536:hwWD51FEDj4FBanDsDS7uO+Y3HBfPGST4BetdSnIDnDWZykftV4bvPbkYI9:NGDjrL7f35FTvtdJOZptV4bbkYS
TLSH
T1F8C36D113BF49071E1E6163D4929A3215B7FBA3199B0E8CF6B484A5E2E711C1DF7A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Users\Admin\AppData\Local\Temp\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\.ba1\license.rtf
Size 6KB
SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
MD5 1e47ee7b71b22488068343df4ce30534
SHA1 deaee13f21ab70b57f44f0aa3128ec7ad9e3816a
SHA512 c4c653bfd1fc493b0efd8f9c75495287818179dc35969d1fb1927faac3ff9189fde1131c5abbcc3963f707412a7f8ad05a9e6855b7d47d6df1f80d25d67be9ed
SSDEEP 192:qMIJdg+CSWA2NLtMqAEwRceNlC8xiYOlTGyDtsFSpM52:IIATECl1i95Zw2
TLSH
T194E1C6FD2243DAE0069F1399194194C6FB0F0F79DDBF7E50B5B69110126291C727EAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI217.tmp

Path C:\Windows\Installer\MSI217.tmp
Size 93KB
SHA256 fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
MD5 186694813c3d5e33202a1a72c5079cc3
SHA1 90a9c2bf6419be6f46999e137c2149feca62cd13
SHA512 57bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b
SSDEEP 1536:NOTekneIYoT5jmIN0gaD4Prbde67Z9AlIZzxIgU9rHUD:NOTekSoT5jr0BDKEawIZzx3U9oD
TLSH
T16F934B4523E840B6E5B7927CC9F69A06E772B4411739A3CF1174829E1F63BC49E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA7F.tmp

Path C:\Windows\Installer\MSIA7F.tmp
Size 74KB
SHA256 be2ead50c4cd94d33c7f1e7c00b47744cb4b4309dcb349236cdcd447265ecf4b
MD5 d557e10dd63535aae79b780fbf83961d
SHA1 67fdf4459fab259f61da7ddd342261243b916a94
SHA512 ab7d5ec81a3e4367b51deac213da79f9b3a6f5be505f4900121b19bffee4366dabf9674753f6ea82e35a88080b85b1e0f2eca790630f879f850aa322e4068feb
SSDEEP 1536:C/sWkKt5Qr09UcBO8IDNg3D+VYBli7woHKy5bJuR3nW+d:SJ5Qr09nGe3D+VYawa5bJc3nW
TLSH
T10B739D213651C375C19728B5E57AC2716A3E74201FE488CE7BA60B7E5E322C17A7B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID70F.tmp

Path C:\Windows\Installer\MSID70F.tmp
Size 87KB
SHA256 76cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
MD5 46790e2748ddb98e3d6115a5f0360ed7
SHA1 d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA512 c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
SSDEEP 1536:DoihL9JEfu0VmWFyzIR41Moen9s2O35S5tTg6F51:Doi9JQgvJVJS5pNF51
TLSH
T1C2935B2179A0C03AECD222BD26ADA650567DB8B14778C8C7779D03EDDD207D0E73A35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE269.tmp

Path C:\Windows\Installer\MSIE269.tmp
Size 80KB
SHA256 bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
MD5 393da89078925f78e19445882c37fc59
SHA1 1313f4e6c62670f1b10aaec77c105be275f50121
SHA512 aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
SSDEEP 1536:d+/OTT4YIb6rkCGoNGXbGKauVj4eKtHa/cJg95k:4OTMYRradauqCcJg95k
TLSH
T1AC832A2179E1C231E8E2777406FCA6622D7D78B14778D4CB778842ED8AA17C09B39367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFA58.tmp

Path C:\Windows\Installer\MSIFA58.tmp
Size 97KB
SHA256 8178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
MD5 d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1 a520426523be085ec67291241f4219ab13f4d4b8
SHA512 def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
SSDEEP 1536:PpK0p0Chu240kmktdDMKVDo9PkzcGzFukFqbbffCfBX5a3/L6F5De:PQChu2VksKCM4GzFubfqfBX5avuF5K
TLSH
T1C0A36C5463E8107AE467827ECDE65A4AFB31B4050779A3CF032586991F33BD5AF3A312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{2D055FDC-71A9-4D7D-A879-C403EB6AE993}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{9EB7DF2A-0EC0-4ADF-88B0-2C3145EAA69D}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{9EB7DF2A-0EC0-4ADF-88B0-2C3145EAA69D}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_000_vcRuntimeMinimum_x64.log

Path C:\Windows\dd_vcredist_amd64_000_vcRuntimeMinimum_x64.log
Size 1KB
SHA256 71feb386316638e1c34a7d28a2fa6fe4ce981b4cf0915e5fd76800e936f898e9
MD5 9c2637390a6de1e0f4257f23d4d3d6e0
SHA1 e2f8946b10e2f906366a80fd248228ba8f8b5538
SHA512 bca806b1e50604f846c30be23fe4aac3d9da6160d4abad65dae51240f137f5b3f09d1f9cc1a37308e90759123fd758085a66e8f378e261ae4975d9de039579a2
TLSH
T13741F5691ED90806B1B35647EDF3C0911A33BCC36834CF0D2388925D076FD06A96C7BA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/888-1933-0x0000000000550000-0x00000000005C7000-memory.dmp

Download

memory/1096-1923-0x00000000003C0000-0x0000000000425000-memory.dmp

Download

memory/1116-2107-0x0000000000550000-0x00000000005C7000-memory.dmp

Download

memory/2484-1935-0x0000000000550000-0x00000000005C7000-memory.dmp

Download

memory/2780-1819-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/2876-1820-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/4148-2108-0x0000000000550000-0x00000000005C7000-memory.dmp

Download

memory/4240-1679-0x00000000003C0000-0x0000000000425000-memory.dmp

Download

memory/4452-2038-0x0000000000B60000-0x0000000000BC5000-memory.dmp

Download

memory/4516-1678-0x00000000003C0000-0x0000000000425000-memory.dmp

Download

memory/4640-2060-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/4848-1936-0x0000000000550000-0x00000000005C7000-memory.dmp

Download

memory/5380-1817-0x0000000000410000-0x0000000000487000-memory.dmp

Download

memory/5552-1922-0x00000000003C0000-0x0000000000425000-memory.dmp

Download

memory/5632-2036-0x0000000000B60000-0x0000000000BC5000-memory.dmp

Download

memory/6088-2057-0x0000000000410000-0x0000000000487000-memory.dmp

Download