Analysis
- user interaction
yes - max time kernel
153s - max time network
357s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 15:01
General
- Target Scritchy-Scratchy-SteamRIP.com.rar
- Size 211.0MB
- Sample260910-sdwlssyygv
- SHA256 fd358eacff1fb7abd4b3265d4226ccf994b1bac62fba6454d6f787b17f9b057c
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 17 IoCs
- Adds Run key to start application 2 TTPs 10 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 55 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 18 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 57 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies data under HKEY_USERS 26 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 23 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Scritchy-Scratchy-SteamRIP.com.rar"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Read_Me_Instructions.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_CommonRedist\_redist_readme.txt1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\_CommonRedist\xnafx40_redist.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 866B48E85074BB13F7DE019235907EC02⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E0D29622D46F662B67E1160A733924BF2⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FC927B48F3208DE4903AB7237055C63C2⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8318E63F5F6288D859578EC7BB8109D42⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 06CBF3EA3F0FCE38F95F6C52816854502⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28129291A9553CD6BE112A43B1982CC22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F5DDED5DB635890E0F4D8336DBE154212⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding A1A6B696757C90C5B9A86EA0C3F4692B2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4A63A5AEA1C72DDE46DAD907CD5AB308 M Global\MSI00002⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6C8595EC38144E7940DD144F82ECAD98 E Global\MSI00002⤵
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 72FE0E15632006D372B8D62EFCB2CB47 E Global\MSI00002⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵
-
-
-
C:\Users\Admin\Desktop\_CommonRedist\VisualCppRedist_AIO_x86_x64.exe"C:\Users\Admin\Desktop\_CommonRedist\VisualCppRedist_AIO_x86_x64.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ver"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /c:" 5."3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\reg.exereg.exe query "HKU\S-1-5-19"3⤵
-
-
C:\Windows\system32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind /i "ComputerSystem"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v productname4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex4⤵
-
-
-
C:\Windows\system32\reg.exereg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled3⤵
-
-
C:\Windows\system32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4733⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.61135.4003⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40664.03⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 50.35719.03⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F03⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A3⤵
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"3⤵
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{3D376344-34AE-4807-A4D3-4FAB97E144EB} {C8450E1B-8450-440B-9BB5-68CBCF2DAA26} 66524⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f3⤵
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{F7FF38DD-8240-4A07-9799-10A186C965E7} {8A40D5B8-EE1A-494F-8824-F16905F233AD} 30804⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f3⤵
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{CE62B694-25AD-4196-A75A-6EC9AF0DB165} {2714EA4E-8506-4017-9DFE-1ED42AC64E45} 61484⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f3⤵
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{74262DE3-AEAD-455E-827C-9DEABEFDF89A} {80551BE6-6734-4298-897A-D8E668ABC870} 50964⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E3878578-C08F-4AB4-BFC8-D5BD35AA6C19} {060DF068-1E68-4480-9261-AAE2C105003C} 24245⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f3⤵
- Modifies registry key
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart3⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /uninstall /passive /norestart4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{64CADDFE-D16A-4B37-BA66-127CDF9D90F2} {296F9CE1-E9C8-4682-AFBD-41FE1C2798A1} 58125⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart3⤵
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString3⤵
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart3⤵
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.60917.03⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "TRIN_TRIR_SETUP"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cscript.execscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo 0.40219.4733⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.50727.6229"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /v /c:"0.30729.7523"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D3⤵
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "VC_RED_enu_"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s3⤵
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s3⤵
- Modifies registry key
-
-
C:\Windows\system32\find.exefind /i "HKEY_LOCAL_MACHINE"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /r "{.*-.*-.*-.*-.*}"3⤵
-
-
C:\Windows\system32\findstr.exefindstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart3⤵
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString3⤵
- Modifies registry key
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart3⤵
-
-
C:\Windows\system32\reg.exereg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f3⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" /qb3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
-
-
C:\Windows\system32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString3⤵
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart3⤵
-
-
C:\Windows\system32\msiexec.exeMsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart3⤵
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb3⤵
-
-
-
C:\Users\Admin\Desktop\_CommonRedist\oalinst.exe"C:\Users\Admin\Desktop\_CommonRedist\oalinst.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\_CommonRedist\dxwebsetup.exe"C:\Users\Admin\Desktop\_CommonRedist\dxwebsetup.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\_CommonRedist\dotNetFx40_Full_setup.exe"C:\Users\Admin\Desktop\_CommonRedist\dotNetFx40_Full_setup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
F:\8152fd2cf4cade7109e1\Setup.exeF:\8152fd2cf4cade7109e1\\Setup.exe /x86 /x64 /ia64 /web2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?LinkId=1641563⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c8,0x7ffa5529c188,0x7ffa5529c194,0x7ffa5529c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,15288324717785037469,6043925014943593866,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,2615790894113875394,16794621764198112370,262144 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,10386123789004167734,12809159383114683674,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,14484529062430990897,10463532975042953119,2097152 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,5848408691406704124,1585967432044166218,2097152 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,2597633475463769716,8125015546561377336,2097152 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3374047257650992370,8838063383160188999,2097152 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,17260483687557511083,15244687857536613119,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,10007793080098082747,7547828601800897598,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,6724539298365788638,15952897826244910211,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,8736925088031401781,16178159902944140237,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5892,i,9315756536507880262,3038288596731531602,2097152 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,825383651864553201,13513335863374175072,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,16650112311906280903,653883767066570395,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,16650112311906280903,653883767066570395,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,3987815319242756642,16933255761480623576,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,9532418558922200636,6784227079432184349,524288 --field-trial-handle=2520,i,1274948707729206510,17073912853507031226,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffa5529c188,0x7ffa5529c194,0x7ffa5529c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,5371091598450761010,811303491372185532,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,14896314710781053704,16248872767825464906,262144 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,7472314180906270312,6540946062840830975,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,12236273080497971263,6345913428433294639,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,12236273080497971263,6345913428433294639,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,12162314312165856041,7825508679242973620,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,2696886997867376796,11866037688648517601,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,14093644032668838885,3823811495918006858,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,5663690267384352459,14694866895069972834,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4948,i,12941994303792588826,2933083693995491018,262144 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:105⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,11439541348145831421,18273475851915338686,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,4481302865415892978,18059255038649942212,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3184,i,12171356592782614002,14381370535446630072,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8734148616998565203,11214790100650200481,524288 --field-trial-handle=2600,i,2428678051078662084,15147301100840783728,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:145⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910160816.log" /uninstall /passive /norestart ignored /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910160816.log /uninstall /passive /norestart ignored2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910160816.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{0EDB7691-B77B-41AB-A45B-C79EFC62F636} {78271994-CFAB-4502-AA4B-C6FE2A097228} 44563⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910160840.log" /uninstall /passive /norestart ignored /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910160840.log /uninstall /passive /norestart ignored2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910160840.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{860D1A07-A1C1-4344-B72B-7863B1DA17DB} {ABE40F52-5E16-4F0A-9AD3-DD8AA1D19034} 46163⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910160842.log"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910160842.log" -burn.unelevated BurnPipe.{32745106-A6EF-4553-B1A4-B61CD88FA01B} {0BC6E74C-E8D3-410A-A675-F9097BBCB989} 65603⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910160845.log"2⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910160845.log" -burn.unelevated BurnPipe.{621D7204-7DD8-42F9-9F2A-75E2396825C0} {C627A0E3-D50D-4452-916F-9EDC73E23109} 62843⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910160849.log"2⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260910160849.log"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce1⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910160852.log"2⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910160852.log"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\Scritchy Scratchy\ScritchyScratchy.exe"C:\Users\Admin\Desktop\Scritchy Scratchy\ScritchyScratchy.exe"1⤵
-
C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe"C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe" --attach 7164 26932359372802⤵
-
C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe"C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe" "7164" "2693235937280" "cbmUrl=" "cbmFile="3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D01⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
-
C:\Users\Admin\Desktop\Scritchy Scratchy\ScritchyScratchy.exe"C:\Users\Admin\Desktop\Scritchy Scratchy\ScritchyScratchy.exe"1⤵
-
C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe"C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe" --attach 2556 24119858995202⤵
-
C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe"C:\Users\Admin\Desktop\Scritchy Scratchy\UnityCrashHandler64.exe" "2556" "2411985899520" "cbmUrl=" "cbmFile="3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
e5bcc67.rbs
e5bcc7a.rbs
e5bcc7e.rbs
e5bcc91.rbs
e5bcc98.rbs
e5bcca9.rbs
e5bccae.rbs
e5bccbf.rbs
e5bccc7.rbs
e5bccd8.rbs
e5bccdf.rbs
e5bccf0.rbs
e5bccfe.rbs
e5bcd02.rbs
e5bcd26.rbf
e5bcd29.rbs
e5bcd2d.rbs
e5bcd5f.rbs
e5bcd66.rbs
e5bcd6b.rbs
e5bcd70.rbs
e5bcd75.rbs
e5bcd7a.rbs
e5bcd7f.rbs
e5bcd8e.rbs
e5bcd95.rbs
e5bcd9d.rbs
e5bcda2.rbs
e5bcdb1.rbs
e5bcdb6.rbs
e5bcdb7.rbf
e5bcdb8.rbf
e5bcdb9.rbf
e5bcdba.rbf
e5bcdbb.rbf
e5bcdbc.rbf
e5bcdbd.rbf
e5bcdbe.rbf
e5bcdbf.rbf
e5bcdc0.rbf
e5bcdc1.rbf
e5bcdc2.rbf
e5bcdc3.rbf
e5bcdc4.rbf
e5bcdc5.rbf
e5bcdc6.rbf
e5bcdc7.rbf
e5bcdc8.rbf
e5bcdc9.rbf
e5bcdca.rbf
e5bcdcb.rbf
e5bcdcc.rbf
e5bcdcd.rbf
e5bcdce.rbf
e5bcdcf.rbf
e5bcdd0.rbf
e5bcdd1.rbf
e5bcdd2.rbf
e5bcdd3.rbf
e5bcdd4.rbf
e5bcdd5.rbf
e5bcdd6.rbf
e5bcdd7.rbf
e5bcdd8.rbf
e5bcdd9.rbf
e5bcdda.rbf
e5bcddb.rbf
e5bcddc.rbf
e5bcddd.rbf
e5bcdde.rbf
e5bcddf.rbf
e5bcde0.rbf
e5bcde1.rbf
e5bcde2.rbf
e5bcde3.rbf
e5bcde4.rbf
e5bcde5.rbf
c
s
s
settings.dat
settings.dat
settings.dat
settings.dat
20a7835a-c16b-480d-9b8b-20c106e5e9a3.tmp
9aec5a35-b080-4209-a516-21238cc8bd0e.tmp
the-real-index
the-real-index~RFe5b2ecd.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
cbae3865-e280-476d-8711-554e6a11d112.tmp
OperationConfig
OperationConfig~RFe5c1e9b.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
metadata.json
metadata.json
5609ef11-6d05-4067-8dfc-3984dd96c4fd.tmp
vc_red.msi
Installer.cmd
ucrtbase.dll
ucrtbase.dll
vcrun.msi
Microsoft.Office.Tools.v9.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll
Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
HFI482.tmp.html
DXI4D51.tmp
dsetup.dll
dsetup32.dll
dxupdate.cif
dxwsetup.cif
dxwsetup.exe
dxwsetup.inf
msi.txt
msi.txt
content_new.js
wix.txt
logo.png
license.rtf
thm.wxl
thm.xml
wixstdba.dll
license.rtf
wixstdba.dll
configs.user.ini
Read_Me_Instructions.txt
UnityCrashHandler64.exe
VisualCppRedist_AIO_x86_x64.exe
_redist_readme.txt
dotNetFx40_Full_setup.exe
dxwebsetup.exe
oalinst.exe
xnafx40_redist.msi
NETFx4RTM.htm.crdownload
MSI193B.tmp
MSI2261.tmp
MSI34DE.tmp
MSI3D19.tmp
MSIB63C.tmp
MSIE78F.tmp
DirectX.log
DirectX.log
ngen.log
ngen.log
filelist.dat
filelist.dat
license.rtf
thm.xml
wixstdba.dll
Microsoft.Office.Tools.Word.dll
Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
Microsoft.Office.Tools.Word.Implementation.dll
Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
Microsoft.Office.Tools.Common.dll
Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
Microsoft.Office.Tools.Outlook.Implementation.dll
Microsoft.VisualStudio.Tools.Applications.Runtime.dll
Microsoft.Office.Tools.v4.0.Framework.dll
Microsoft.Office.Tools.dll
Microsoft.Office.Tools.Outlook.dll
Microsoft.Office.Tools.Excel.Implementation.dll
Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
Microsoft.Office.Tools.Excel.dll
Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
Microsoft.Office.Tools.Common.Implementation.dll
Microsoft.VisualStudio.Tools.Office.Runtime.dll
dxupdate.cab
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
SetupResources.dll
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
LocalizedData.xml
DHTMLHeader.html
ParameterInfo.xml
Setup.exe
SetupEngine.dll
SetupUi.dll
SetupUi.xsd
SplashScreen.bmp
Strings.xml
UiInfo.xml
print.ico
setup.ico
warn.ico
sqmapi.dll
memory/1264-6222-0x0000000000D80000-0x0000000000DF7000-memory.dmp
memory/1396-7134-0x00000237FA750000-0x00000237FA778000-memory.dmp
memory/1396-7059-0x00000237F9130000-0x00000237F913A000-memory.dmp
memory/1396-7175-0x00000237F9230000-0x00000237F923E000-memory.dmp
memory/1396-7181-0x00000237F9230000-0x00000237F923E000-memory.dmp
memory/1396-7187-0x00000237F9230000-0x00000237F923E000-memory.dmp
memory/1396-7194-0x00000237F9130000-0x00000237F913A000-memory.dmp
memory/1396-7200-0x00000237FA890000-0x00000237FA8BA000-memory.dmp
memory/1396-7207-0x00000237FA890000-0x00000237FA8C4000-memory.dmp
memory/1396-7213-0x00000237FA6E0000-0x00000237FA73C000-memory.dmp
memory/1396-7225-0x00000237F9130000-0x00000237F913E000-memory.dmp
memory/1396-7231-0x00000237FA380000-0x00000237FA398000-memory.dmp
memory/1396-7219-0x00000237FA380000-0x00000237FA39A000-memory.dmp
memory/1396-7238-0x00000237F9130000-0x00000237F913A000-memory.dmp
memory/1396-7245-0x00000237FA380000-0x00000237FA394000-memory.dmp
memory/1396-7251-0x00000237FA380000-0x00000237FA394000-memory.dmp
memory/1396-7258-0x00000237FA360000-0x00000237FA378000-memory.dmp
memory/1396-7264-0x00000237FA3A0000-0x00000237FA3D6000-memory.dmp
memory/1396-7271-0x00000237FA3A0000-0x00000237FA3D4000-memory.dmp
memory/1396-7278-0x00000237F9130000-0x00000237F913C000-memory.dmp
memory/1396-7285-0x00000237F9130000-0x00000237F9138000-memory.dmp
memory/1396-7292-0x00000237F9510000-0x00000237F952C000-memory.dmp
memory/1396-7298-0x00000237FA360000-0x00000237FA38E000-memory.dmp
memory/1396-7304-0x00000237F9510000-0x00000237F9522000-memory.dmp
memory/1396-7311-0x00000237FA360000-0x00000237FA388000-memory.dmp
memory/1396-7317-0x00000237FA3C0000-0x00000237FA41C000-memory.dmp
memory/1396-7324-0x00000237FA450000-0x00000237FA4C6000-memory.dmp
memory/1396-7331-0x00000237FA360000-0x00000237FA386000-memory.dmp
memory/1396-7338-0x00000237FA3C0000-0x00000237FA418000-memory.dmp
memory/1396-7345-0x00000237F9510000-0x00000237F9526000-memory.dmp
memory/1396-7351-0x00000237FA3D0000-0x00000237FA436000-memory.dmp
memory/1396-7358-0x00000237FA360000-0x00000237FA386000-memory.dmp
memory/1396-7158-0x00000237FA780000-0x00000237FA794000-memory.dmp
memory/1396-7154-0x00000237FA6C0000-0x00000237FA6D4000-memory.dmp
memory/1396-7146-0x00000237F9A50000-0x00000237F9A5E000-memory.dmp
memory/1396-7131-0x00000237FA830000-0x00000237FA888000-memory.dmp
memory/1396-7150-0x00000237FA490000-0x00000237FA49E000-memory.dmp
memory/1396-7063-0x00000237FA360000-0x00000237FA394000-memory.dmp
memory/1396-7066-0x00000237F9150000-0x00000237F915A000-memory.dmp
memory/1396-7070-0x00000237FA3A0000-0x00000237FA3CA000-memory.dmp
memory/1396-7073-0x00000237F9230000-0x00000237F923E000-memory.dmp
memory/1396-7077-0x00000237FA3D0000-0x00000237FA406000-memory.dmp
memory/1396-7080-0x00000237F9510000-0x00000237F9528000-memory.dmp
memory/1396-7083-0x00000237FA450000-0x00000237FA484000-memory.dmp
memory/1396-7086-0x00000237FA530000-0x00000237FA58C000-memory.dmp
memory/1396-7089-0x00000237FA410000-0x00000237FA42C000-memory.dmp
memory/1396-7092-0x00000237FA430000-0x00000237FA446000-memory.dmp
memory/1396-7095-0x00000237F94F0000-0x00000237F94F8000-memory.dmp
memory/1396-7098-0x00000237FA4B0000-0x00000237FA4C8000-memory.dmp
memory/1396-7101-0x00000237FA610000-0x00000237FA686000-memory.dmp
memory/1396-7104-0x00000237FA590000-0x00000237FA5BE000-memory.dmp
memory/1396-7107-0x00000237F9500000-0x00000237F950E000-memory.dmp
memory/1396-7110-0x00000237FA5C0000-0x00000237FA5E6000-memory.dmp
memory/1396-7113-0x00000237FA4D0000-0x00000237FA4E2000-memory.dmp
memory/1396-7116-0x00000237FA6F0000-0x00000237FA74E000-memory.dmp
memory/1396-7128-0x00000237FA4F0000-0x00000237FA50A000-memory.dmp
memory/1396-7125-0x00000237F9530000-0x00000237F953C000-memory.dmp
memory/1396-7122-0x00000237FA690000-0x00000237FA6B6000-memory.dmp
memory/1396-7119-0x00000237FA7C0000-0x00000237FA826000-memory.dmp
memory/1992-6163-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/1996-6074-0x0000000000D80000-0x0000000000DF7000-memory.dmp
memory/2424-5962-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/2592-5963-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/2640-7569-0x000000001C910000-0x000000001CDDE000-memory.dmp
memory/2640-7562-0x000000001BFF0000-0x000000001BFFE000-memory.dmp
memory/2640-7571-0x000000001BF90000-0x000000001BF9C000-memory.dmp
memory/2640-7564-0x000000001C0C0000-0x000000001C0D6000-memory.dmp
memory/2640-7559-0x000000001BFF0000-0x000000001BFFC000-memory.dmp
memory/2640-7565-0x000000001C0A0000-0x000000001C0AE000-memory.dmp
memory/2640-7567-0x000000001BFD0000-0x000000001BFE8000-memory.dmp
memory/2640-7568-0x000000001C090000-0x000000001C0AA000-memory.dmp
memory/2640-7566-0x000000001BFF0000-0x000000001BFFE000-memory.dmp
memory/2640-7573-0x000000001C4A0000-0x000000001C548000-memory.dmp
memory/2640-7560-0x000000001BFF0000-0x000000001BFFA000-memory.dmp
memory/2640-7561-0x000000001BFF0000-0x000000001BFFE000-memory.dmp
memory/2640-7558-0x000000001BFF0000-0x000000001BFFA000-memory.dmp
memory/2640-7557-0x0000000001A30000-0x0000000001A3E000-memory.dmp
memory/2640-7556-0x000000001BF60000-0x000000001BF8C000-memory.dmp
memory/2640-7563-0x000000001C3F0000-0x000000001C438000-memory.dmp
memory/2640-7570-0x000000001CDE0000-0x000000001D0F4000-memory.dmp
memory/2640-7572-0x000000001BF90000-0x000000001BF9C000-memory.dmp
memory/2988-6071-0x0000000000D80000-0x0000000000DF7000-memory.dmp
memory/3080-5749-0x0000000000550000-0x00000000005AE000-memory.dmp
memory/3880-5748-0x0000000000550000-0x00000000005AE000-memory.dmp
memory/4288-5852-0x0000000000470000-0x00000000004D5000-memory.dmp
memory/4456-5824-0x0000000000910000-0x000000000096E000-memory.dmp
memory/4616-5907-0x0000000000550000-0x00000000005AE000-memory.dmp
memory/4808-5823-0x0000000000910000-0x000000000096E000-memory.dmp
memory/5096-5853-0x0000000000470000-0x00000000004D5000-memory.dmp
memory/5812-6073-0x0000000000D80000-0x0000000000DF7000-memory.dmp
memory/5924-6221-0x0000000000D80000-0x0000000000DF7000-memory.dmp
memory/6148-5796-0x0000000000340000-0x00000000003A5000-memory.dmp
memory/6180-5960-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/6284-6088-0x0000000000470000-0x00000000004D5000-memory.dmp
memory/6376-5795-0x0000000000340000-0x00000000003A5000-memory.dmp
memory/6556-6017-0x0000000000340000-0x00000000003A5000-memory.dmp
memory/6560-6018-0x0000000000340000-0x00000000003A5000-memory.dmp
memory/6600-5906-0x0000000000550000-0x00000000005AE000-memory.dmp
memory/6652-5704-0x0000000000910000-0x000000000096E000-memory.dmp
memory/6724-6164-0x0000000000DB0000-0x0000000000E27000-memory.dmp
memory/6832-5703-0x0000000000910000-0x000000000096E000-memory.dmp
memory/6840-5649-0x000002CACFBC0000-0x000002CACFC08000-memory.dmp
memory/6840-5648-0x000002CACF740000-0x000002CACF762000-memory.dmp
memory/7132-6087-0x0000000000470000-0x00000000004D5000-memory.dmp