Overview

overview

10

Static

static

7

Pumpkhn_Un...1).exe

windows10-2004-x64

9

Pumpkhn_Un...1).exe

windows11-ltsc_2024-x64

9

Pumpkhn_Un...ep.exe

windows10-2004-x64

10

Pumpkhn_Un...ep.exe

windows11-ltsc_2024-x64

10

Pumpkhn_Un...IN.exe

windows10-2004-x64

3

Pumpkhn_Un...IN.exe

windows11-ltsc_2024-x64

3

Pumpkhn_Un...64.exe

windows10-2004-x64

1

Pumpkhn_Un...64.exe

windows11-ltsc_2024-x64

1

Pumpkhn_Un...16.exe

windows10-2004-x64

Pumpkhn_Un...16.exe

windows11-ltsc_2024-x64

Pumpkhn_Un...IT.exe

windows10-2004-x64

1

Pumpkhn_Un...IT.exe

windows11-ltsc_2024-x64

1

Pumpkhn_Un...LL.dll

windows10-2004-x64

3

Pumpkhn_Un...LL.dll

windows11-ltsc_2024-x64

3

Pumpkhn_Un...YS.sys

windows10-2004-x64

3

Pumpkhn_Un...YS.sys

windows11-ltsc_2024-x64

3

Pumpkhn_Un...64.sys

windows10-2004-x64

3

Pumpkhn_Un...64.sys

windows11-ltsc_2024-x64

3

Pumpkhn_Un...64.sys

windows10-2004-x64

3

Pumpkhn_Un...64.sys

windows11-ltsc_2024-x64

3

Pumpkhn_Un...H1.exe

windows10-2004-x64

3

Pumpkhn_Un...H1.exe

windows11-ltsc_2024-x64

8

Pumpkhn_Un...er.exe

windows10-2004-x64

6

Pumpkhn_Un...er.exe

windows11-ltsc_2024-x64

6

Pumpkhn_Un...AC.exe

windows10-2004-x64

7

Pumpkhn_Un...AC.exe

windows11-ltsc_2024-x64

8

Pumpkhn_Un...er.bat

windows10-2004-x64

4

Pumpkhn_Un...er.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    902s
  • max time network
    551s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 12:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/CleanBan_SysPrep.exe
  • Size 96.2MB
  • Sample261102-p77pdatwht
  • SHA256 90382ea191a1bca4ae68ae5d5cd1f6a5173dca8bd70f119b8eec305098ae24c6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 41 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 2 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 2 IoCs
    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 37 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\CleanBan_SysPrep.exe
    "C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\CleanBan_SysPrep.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5660
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell.exe -Command "Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -Command "Set-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name ConsentPromptBehaviorAdmin -Value 0"
        3⤵
        • UAC bypass
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3508
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /wait C:\Users\Admin\AppData\Local\Temp\disable-defender.exe -s
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5956
      • C:\Users\Admin\AppData\Local\Temp\disable-defender.exe
        C:\Users\Admin\AppData\Local\Temp\disable-defender.exe -s
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3424
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cd %temp%\runtimes\ && tar -xf C:\Users\Admin\AppData\Local\Temp\runtimes\runtimes.zip
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\system32\tar.exe
        tar -xf C:\Users\Admin\AppData\Local\Temp\runtimes\runtimes.zip
        3⤵
          PID:2672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c start /wait C:\Users\Admin\AppData\Local\Temp\runtimes\install_all.bat
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\runtimes\install_all.bat
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3216
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2005_x86.exe
            vcredist2005_x86.exe /q
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:260
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec /i vcredist.msi
              5⤵
              • Enumerates connected drives
              • Event Triggered Execution: Installer Packages
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:3892
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2005_x64.exe
            vcredist2005_x64.exe /q
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1796
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec /i vcredist.msi
              5⤵
              • Enumerates connected drives
              • Event Triggered Execution: Installer Packages
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:4900
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2008_x86.exe
            vcredist2008_x86.exe /qb
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4996
            • \??\f:\805606d076b3f12830\install.exe
              f:\805606d076b3f12830\.\install.exe /qb
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:1504
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2008_x64.exe
            vcredist2008_x64.exe /qb
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1488
            • \??\f:\a1d2d608c88aaace2684\install.exe
              f:\a1d2d608c88aaace2684\.\install.exe /qb
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:4472
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2010_x86.exe
            vcredist2010_x86.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5092
            • \??\f:\d44c8309b88f36d59f0b595b56\Setup.exe
              f:\d44c8309b88f36d59f0b595b56\Setup.exe /passive /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks system information in the registry
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • System policy modification
              PID:4676
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2010_x64.exe
            vcredist2010_x64.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:6112
            • \??\f:\87d44e472a5808b4a99ddff3f5a2c000\Setup.exe
              f:\87d44e472a5808b4a99ddff3f5a2c000\Setup.exe /passive /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:6104
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2012_x86.exe
            vcredist2012_x86.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2748
            • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2012_x86.exe
              "C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2012_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{80C8602B-3FF4-4604-B4F6-B9395F51C8C8} {64C6BFF5-A039-4203-B114-9E75E4BB7215} 2748
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:252
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2012_x64.exe
            vcredist2012_x64.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5204
            • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2012_x64.exe
              "C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2012_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{BA003EF8-8425-4AD2-A1E2-4794D132C11B} {2235D0AF-ADB9-454E-B8DE-2F2C35003B6C} 5204
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:4872
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2013_x86.exe
            vcredist2013_x86.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3060
            • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2013_x86.exe
              "C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2013_x86.exe" /passive /norestart -burn.unelevated BurnPipe.{95D1F955-6866-442D-924D-2D7E65EF4536} {CFD1774F-957F-4884-85F2-51C431EB832E} 3060
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:4828
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 888
                6⤵
                • Program crash
                PID:3264
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2013_x64.exe
            vcredist2013_x64.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2868
            • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2013_x64.exe
              "C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2013_x64.exe" /passive /norestart -burn.unelevated BurnPipe.{1D634CAF-F492-4FA9-B6D4-4503CABC13BC} {24FBFDE9-05F6-4C6C-B6FC-AC31FE824363} 2868
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:3768
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 896
                6⤵
                • Program crash
                PID:2404
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2015_2017_2019_2022_x86.exe
            vcredist2015_2017_2019_2022_x86.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            PID:4296
            • C:\Windows\Temp\{2B09E931-C411-432D-947A-22000CF1CD48}\.cr\vcredist2015_2017_2019_2022_x86.exe
              "C:\Windows\Temp\{2B09E931-C411-432D-947A-22000CF1CD48}\.cr\vcredist2015_2017_2019_2022_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2015_2017_2019_2022_x86.exe" -burn.filehandle.attached=612 -burn.filehandle.self=428 /passive /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:5088
              • C:\Windows\Temp\{22CA835F-6764-4A91-B083-36BB22C74F59}\.be\VC_redist.x86.exe
                "C:\Windows\Temp\{22CA835F-6764-4A91-B083-36BB22C74F59}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{78E32A0B-7268-4142-BDFD-5DB4340A8ED6} {A34A3E0A-2C0C-47C6-8F61-9AB20F3AAD88} 5088
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                PID:2736
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 892
                6⤵
                • Program crash
                PID:4756
          • C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2015_2017_2019_2022_x64.exe
            vcredist2015_2017_2019_2022_x64.exe /passive /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4532
            • C:\Windows\Temp\{04FE6EBC-1E24-42AC-A68B-9223C731AD59}\.cr\vcredist2015_2017_2019_2022_x64.exe
              "C:\Windows\Temp\{04FE6EBC-1E24-42AC-A68B-9223C731AD59}\.cr\vcredist2015_2017_2019_2022_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2015_2017_2019_2022_x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=604 /passive /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:4536
              • C:\Windows\Temp\{427A4EF7-5C40-44BD-BD84-5537552CA364}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{427A4EF7-5C40-44BD-BD84-5537552CA364}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{91D97D2B-8761-48D1-A30B-A1DFF37C0BF5} {2943E346-C3D6-4708-9C52-B5AC426D4EBE} 4536
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                PID:5640
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1076
                6⤵
                • Program crash
                PID:2792
          • C:\Users\Admin\AppData\Local\Temp\runtimes\dxwebsetup.exe
            dxwebsetup.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            PID:4700
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              PID:596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powercfg /h off
        2⤵
        • Power Settings
        PID:2736
        • C:\Windows\system32\powercfg.exe
          powercfg /h off
          3⤵
          • Power Settings
          PID:5252
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1572
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 581405F1CAD23156D53683C3C3BD4D0E
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1200
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding E1EBEE51CDDBF30427C033FCF05A0248
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3256
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored /burn.runonce
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1208
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored -burn.unelevated BurnPipe.{2FC4862C-957C-4310-94B1-D4023B564A03} {24F70CA2-9706-472F-9B4C-CE5566C4587E} 1208
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:3696
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored /burn.runonce
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:6084
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{16E16268-FB3B-4BE2-9E78-1D91360552EE} {F40C8F0C-A4A3-4D3C-BE4C-5520DDFC4CCC} 3148
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:424
    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored /burn.runonce
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:3316
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored -burn.unelevated BurnPipe.{1D01FA86-51F8-456B-A80C-07C690A0BCB5} {2BF3745F-64F9-4DF4-8B50-EB07A948CDF2} 5004
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:4572
    • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130155.log"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\vcredist_x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130155.log" -burn.unelevated BurnPipe.{0E171E55-C331-47AA-A4FD-AD7E3C871A50} {D76F5C45-F9CE-43C7-ABF9-DE35967CC645} 4216
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:1656
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1080
            4⤵
            • Program crash
            PID:4400
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored /burn.runonce
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5652
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{C324476C-075C-4B7C-99C8-266D1F00F041} {8F2AF539-F06A-44EE-9909-CF078F9544CA} 5652
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:2868
    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored /burn.runonce
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored -burn.unelevated BurnPipe.{5154C491-2B1A-44CD-B309-624C5A406A93} {32DD6F07-CDC0-44FB-8A55-F790180CF259} 4924
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:1232
    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored /burn.runonce
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored
        2⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored -burn.unelevated BurnPipe.{CD173423-3B95-452A-B8DA-F3EB01578C23} {E239C179-AB5C-416E-A2DD-B37F9F840DC2} 2704
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:1072
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5988
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{8528AA5F-5417-4EEA-9021-5AFAAE561795} {89B5DD73-9B7B-49C4-B207-5F33E9AB7763} 5988
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:6036
    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored /burn.runonce
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:256
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored -burn.unelevated BurnPipe.{FEB8D47F-D374-4D0C-AF25-701C1E73E94C} {C8884D44-54B4-46EB-90BF-D392D27B501E} 256
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:6004
    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:6068
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1E3372BE-F488-450E-9982-4C4FBB45CDE7} {5DCE3155-F6B7-4577-80DB-D513CF2D61FB} 6068
          3⤵
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:5676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 4828 -ip 4828
      1⤵
        PID:3412
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4516
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D751A6AB-3F38-4115-AE8B-CC6D87CAC0BA} {040AEBFD-B48A-47CF-9049-F894ADCEBE41} 2820
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:2620
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:704
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3612
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{57109809-239E-4D72-A353-0038E124BA70} {8F8BF7A3-9444-438E-B351-C907E52B9632} 3612
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:2064
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored
          2⤵
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3556
          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5CBDD4E4-2617-4DA0-B49B-817B74ADCB8C} {724D3C9A-E88A-479D-B85A-96058C0C7ABA} 3556
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:2152
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3308
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
          2⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1272
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{FC61C40C-4DC4-48F8-B9E9-5B1CA3E236EB} {7DF9D09C-8332-43EE-AFAC-E6B4963C824F} 1272
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:4704
      • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5344
        • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130202.log"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:5188
          • C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe
            "C:\ProgramData\Package Cache\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\vcredist_x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130202.log" -burn.unelevated BurnPipe.{9E4302D7-3E38-4BFF-AFA5-7FBDEAE16D2F} {931D90BE-2149-45AF-8BB6-00F1C3533835} 5188
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:880
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 1112
              4⤵
              • Program crash
              PID:1524
      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
          2⤵
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4736
          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A81471EB-429C-4A3F-8F21-68FC213F5104} {CE62C368-23A9-4FA5-A8EB-49E910707110} 4736
            3⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            PID:4972
      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored /burn.runonce
        1⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5680
        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored
          2⤵
            PID:6076
            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{B5D1A8B2-D3C7-47CB-9D53-D7AECB049972} {6146E713-159F-4136-9173-D6792618A3E7} 6076
              3⤵
              • Loads dropped DLL
              • Suspicious use of FindShellTrayWindow
              PID:2784
        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
          1⤵
            PID:3184
            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
              2⤵
              • Adds Run key to start application
              PID:1236
              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{23CF6AA6-A5FA-4676-A83D-EF73256B7ECD} {8617E276-4E03-409B-BF72-ED94CE1E4E84} 1236
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:5044
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            1⤵
              PID:4572
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3768 -ip 3768
              1⤵
                PID:4580
              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                1⤵
                  PID:4676
                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored
                    2⤵
                      PID:1572
                      • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                        "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D363632A-1709-44C2-85DD-9D337D59B38D} {631F05F7-E1F8-4F57-944A-7AC2AC81EAF1} 1572
                        3⤵
                        • Loads dropped DLL
                        • Suspicious use of FindShellTrayWindow
                        PID:4308
                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                    1⤵
                      PID:4212
                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                        2⤵
                        • Adds Run key to start application
                        PID:2908
                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5961F7E5-019A-47BD-B090-FE9B5956CBAE} {BA303DC9-4411-4E59-99F9-71CA9173DC64} 2908
                          3⤵
                          • Loads dropped DLL
                          • Suspicious use of FindShellTrayWindow
                          PID:824
                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                      1⤵
                        PID:4440
                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored
                          2⤵
                            PID:4368
                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{FA1E0CE1-316E-468F-BF91-F724A71DB1F2} {A2818C9A-AFEC-4C9E-AA74-D549404A66BD} 4368
                              3⤵
                              • Loads dropped DLL
                              • Suspicious use of FindShellTrayWindow
                              PID:5328
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1656 -ip 1656
                          1⤵
                            PID:360
                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                            1⤵
                              PID:2972
                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                2⤵
                                • Adds Run key to start application
                                PID:556
                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{73EB8E46-06C9-4E98-A6CD-2A1DCE79F48B} {2CACA89B-7082-4144-A439-22FEEB3A1C6E} 556
                                  3⤵
                                  • Loads dropped DLL
                                  • Suspicious use of FindShellTrayWindow
                                  PID:4336
                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                              1⤵
                                PID:1248
                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                  2⤵
                                  • Adds Run key to start application
                                  PID:428
                                  • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1BB202E0-C12E-415D-9972-787483101141} {7D0ED12B-6662-4C44-889D-AB311DAB3554} 428
                                    3⤵
                                    • Loads dropped DLL
                                    • Suspicious use of FindShellTrayWindow
                                    PID:3496
                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                1⤵
                                  PID:5732
                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                    2⤵
                                    • Adds Run key to start application
                                    PID:1436
                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{837F2003-B752-4A49-980D-80D7487EDA05} {C048CDFA-923B-443E-8E72-4321BF690FD6} 1436
                                      3⤵
                                      • Loads dropped DLL
                                      • Suspicious use of FindShellTrayWindow
                                      PID:4256
                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                  1⤵
                                    PID:5904
                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                      2⤵
                                        PID:5752
                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7942B1AF-37BF-4AE6-92FD-41BD0E1C6CC9} {CEA88C82-54AF-4395-984A-2B3F6D7D1E0F} 5752
                                          3⤵
                                          • Loads dropped DLL
                                          • Suspicious use of FindShellTrayWindow
                                          PID:4108
                                    • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                      1⤵
                                        PID:3508
                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                          2⤵
                                            PID:2384
                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{147C66C6-0D3A-4E44-B9D6-CF0062FE3DDA} {EC30F9AE-C834-4890-B80D-03B77D5BCF0C} 2384
                                              3⤵
                                              • Loads dropped DLL
                                              • Suspicious use of FindShellTrayWindow
                                              PID:5896
                                        • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                          "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                          1⤵
                                            PID:5124
                                            • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                              "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                              2⤵
                                                PID:1916
                                                • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{6ECF2555-F7EC-413E-BA9B-BA9A4C955961} {FCF8283D-42A3-462C-B3F4-9066409F66AD} 1916
                                                  3⤵
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4688
                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                              1⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1340
                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                2⤵
                                                  PID:3356
                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{CDDE24A4-C1DD-45B8-A458-9FD1479320DC} {D8DD0F98-931C-47F6-8156-8CBB1FF5A665} 3356
                                                    3⤵
                                                    • Loads dropped DLL
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:856
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 880 -ip 880
                                                1⤵
                                                  PID:1260
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5088 -ip 5088
                                                  1⤵
                                                    PID:5604
                                                  • C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe
                                                    "C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe" /burn.runonce
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5180
                                                    • C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe
                                                      "C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130212.log"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:2284
                                                      • C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe
                                                        "C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130212.log"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:3200
                                                        • C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe
                                                          "C:\ProgramData\Package Cache\{46c3b171-c15c-4137-8e1d-67eeb2985b44}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{825D5D50-279D-4E9E-A69A-7626636B7E08} {A76940A2-EE26-4A5A-93F5-6F9EEF0719C1} 3200
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • Modifies registry class
                                                          PID:3892
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 952
                                                          4⤵
                                                          • Program crash
                                                          PID:3572
                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                    1⤵
                                                      PID:4288
                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                        2⤵
                                                        • Adds Run key to start application
                                                        PID:1820
                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{91664FDD-7755-4176-8A21-18A49E7C2225} {B495C73E-D37F-4305-89AF-47649BBC115F} 1820
                                                          3⤵
                                                          • Loads dropped DLL
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:4400
                                                    • C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe
                                                      "C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" /burn.runonce
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:1904
                                                      • C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe
                                                        "C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130215.log"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2988
                                                        • C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe
                                                          "C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130215.log"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:5320
                                                          • C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe
                                                            "C:\ProgramData\Package Cache\{c649ede4-f16a-4486-a117-dcc2f2a35165}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5563CF28-C6B7-496E-A6FB-704B2BEE727E} {7FC3A01A-B799-4C27-8619-5BB66C42EC82} 5320
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Adds Run key to start application
                                                            • Enumerates connected drives
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            PID:1720
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 964
                                                            4⤵
                                                            • Program crash
                                                            PID:5776
                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                      1⤵
                                                        PID:5228
                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                          2⤵
                                                          • Adds Run key to start application
                                                          PID:2416
                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{C846298D-C8E4-47BB-A48F-D2AD5E2FB39C} {E28CA6FA-7F96-4FC7-B089-2A1D3D2C7814} 2416
                                                            3⤵
                                                            • Loads dropped DLL
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:5408
                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                        1⤵
                                                          PID:1408
                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3300
                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{8F62AC27-DD2A-4F40-9A74-9B89FDABC1E0} {B0149E43-4D8D-442D-B606-D4FD1C9AC7E8} 3300
                                                              3⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of FindShellTrayWindow
                                                              PID:5508
                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                          1⤵
                                                            PID:1648
                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                              2⤵
                                                                PID:5324
                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{E8D6C450-222C-4BC8-B22F-24B7DFEAC918} {02B3FCC8-56A8-48DE-8CCA-6DC3E43BD91F} 5324
                                                                  3⤵
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:5776
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4536 -ip 4536
                                                              1⤵
                                                                PID:5604
                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                1⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2776
                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                  2⤵
                                                                  • Adds Run key to start application
                                                                  PID:2040
                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{59C48454-63E5-48B3-AACE-437D9D6D0265} {9A2186F4-EBFA-4B2D-928E-87A96A4D3CC4} 2040
                                                                    3⤵
                                                                    • Loads dropped DLL
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:5140
                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                1⤵
                                                                  PID:4820
                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                    2⤵
                                                                    • Adds Run key to start application
                                                                    PID:4576
                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{FF4CB9AB-42A2-4901-A1A4-9D3A9E44C98D} {B0BB37F3-AF1C-4B04-94E7-E8B033DE31FA} 4576
                                                                      3⤵
                                                                      • Loads dropped DLL
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:4380
                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                  1⤵
                                                                    PID:1896
                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                      2⤵
                                                                        PID:2932
                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{57947A1C-A1B5-44EF-8A58-7C117E037AF6} {5B786943-B67E-433F-940E-D160A16C7DE5} 2932
                                                                          3⤵
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:5780
                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                      1⤵
                                                                        PID:5240
                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                          2⤵
                                                                          • Adds Run key to start application
                                                                          PID:4112
                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5F267145-910C-448C-BDF2-1ACA5C61F86C} {5D25AF46-57EB-48A2-9EB1-FB204C8776C3} 4112
                                                                            3⤵
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            PID:1028
                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                        1⤵
                                                                          PID:4900
                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                            2⤵
                                                                            • Adds Run key to start application
                                                                            PID:1812
                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{F9519706-7230-4A70-A7FA-66D8ECA9BC6D} {F6500906-5E11-4F8C-B456-AE1707A1EDBD} 1812
                                                                              3⤵
                                                                              • Loads dropped DLL
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:5432
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          1⤵
                                                                            PID:2064
                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                            1⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2308
                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                              2⤵
                                                                              • Adds Run key to start application
                                                                              PID:5504
                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{ACFDF39E-D166-4A39-BD26-A023FF27D605} {58C6FCB1-C558-4178-9F1F-F2D9D494FEE9} 5504
                                                                                3⤵
                                                                                • Loads dropped DLL
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:4872
                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                            1⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3784
                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                              2⤵
                                                                                PID:1552
                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{C2BDA52F-1C44-452D-A734-1DA73C3AA5F5} {97D3E1C7-5F3B-422C-809F-4896A90C88C9} 1552
                                                                                  3⤵
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:6092
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3200 -ip 3200
                                                                              1⤵
                                                                                PID:5936
                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                1⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:5564
                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                  2⤵
                                                                                  • Adds Run key to start application
                                                                                  PID:6044
                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{C6BBDE99-9F78-4671-BD39-646373D0B231} {7195ECA5-F345-4CEF-90E9-0A26F9217A00} 6044
                                                                                    3⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:1376
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5320 -ip 5320
                                                                                1⤵
                                                                                  PID:4132
                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                  1⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3584
                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                    2⤵
                                                                                    • Adds Run key to start application
                                                                                    PID:4788
                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{F3F6A109-F27A-4DC9-9C20-ECC022E2D8D6} {16BE06D4-6B61-4C1D-9730-0E8A11F7D632} 4788
                                                                                      3⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:5656
                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                  1⤵
                                                                                    PID:4644
                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                      2⤵
                                                                                      • Adds Run key to start application
                                                                                      PID:5996
                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{2D5DB83C-8C2C-468B-AFAA-496C1FB620AD} {AAF70A86-A115-499E-A26B-5EA0A3E2D2AF} 5996
                                                                                        3⤵
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        PID:5632
                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                    1⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1228
                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                      2⤵
                                                                                      • Adds Run key to start application
                                                                                      PID:4872
                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{18ABE536-1525-4A65-9F2C-B9B3827CEDA7} {3CAA598D-D3C5-47A0-94BB-260A7BF1FB65} 4872
                                                                                        3⤵
                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                        PID:1232
                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                    1⤵
                                                                                      PID:2460
                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                        2⤵
                                                                                        • Adds Run key to start application
                                                                                        PID:4540
                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{77B03A96-EE11-4E13-9366-C05E1CF4E9E9} {CA1ACBB8-1CD8-42F6-BC7E-C4A974C26415} 4540
                                                                                          3⤵
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:5336
                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                      1⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3572
                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                        2⤵
                                                                                        • Adds Run key to start application
                                                                                        PID:2696
                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{71A1FCA9-DB95-41A1-ACB5-DAEED7B3B642} {EC285D79-257D-4CB5-A668-F4C14D68086E} 2696
                                                                                          3⤵
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:6116
                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                      1⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:3240
                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                        2⤵
                                                                                          PID:936
                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{65C30F35-3BBD-4148-8B1B-C819CEEA57E3} {88BF4B5F-3693-4C1C-B005-1BE68C684595} 936
                                                                                            3⤵
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:1320
                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                        1⤵
                                                                                          PID:4248
                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3576
                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{3E5EDE70-A7D1-475F-98CE-4013231C5015} {51F0C011-FE5A-4ADB-A958-E6CE5B9B4EC6} 3576
                                                                                              3⤵
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              PID:780
                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                          1⤵
                                                                                            PID:4672
                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                              2⤵
                                                                                              • Adds Run key to start application
                                                                                              PID:108
                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7234B39D-75A9-4C6F-A95B-68B14C36EF79} {8CEA001D-FF23-4F49-9E43-6863D73A7261} 108
                                                                                                3⤵
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:3016
                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                            1⤵
                                                                                              PID:2584
                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                2⤵
                                                                                                  PID:3108
                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{64928274-3097-45E7-BF67-3363C2E2D183} {1E0BCB38-9166-4353-B4E5-C62226EB2610} 3108
                                                                                                    3⤵
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:5740
                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                1⤵
                                                                                                  PID:1908
                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                    2⤵
                                                                                                    • Adds Run key to start application
                                                                                                    PID:1704
                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9A4D0B34-3A32-41D1-8090-0A2B33D51960} {160639AA-08A5-47D6-ACAD-42C9A0B41554} 1704
                                                                                                      3⤵
                                                                                                        PID:4940
                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                    1⤵
                                                                                                      PID:6056
                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                        2⤵
                                                                                                        • Adds Run key to start application
                                                                                                        PID:3420
                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{A6B827B1-E393-4C6D-9192-B53A6ABD34E0} {B9D21E89-0738-48CC-992D-E3311EC573B7} 3420
                                                                                                          3⤵
                                                                                                            PID:2916
                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                        1⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4620
                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                          2⤵
                                                                                                          • Adds Run key to start application
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:5712
                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{21782275-640C-461F-9E8D-41A8586728CA} {A5AC05C3-E59D-4802-A9EF-4825CB38B2FE} 5712
                                                                                                            3⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2768
                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                        1⤵
                                                                                                          PID:4088
                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                            2⤵
                                                                                                            • Adds Run key to start application
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:788
                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{206C4561-4F0D-468A-BD43-24350177E246} {0560084D-0FA7-4B57-A3EF-5E8889E4C7AF} 788
                                                                                                              3⤵
                                                                                                                PID:4416
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            1⤵
                                                                                                              PID:780
                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                              1⤵
                                                                                                                PID:5512
                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                  2⤵
                                                                                                                    PID:2912
                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{BC1E5741-F242-4C35-B99B-D0533705F2D5} {243618F4-E0A5-4F21-B510-CF3BCD29206E} 2912
                                                                                                                      3⤵
                                                                                                                        PID:5872
                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                    1⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2920
                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                      2⤵
                                                                                                                      • Adds Run key to start application
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5288
                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9F6AD284-45D6-4880-9F55-6C9300597D6B} {11AAF8CF-43C0-427E-8CC8-559A6D365211} 5288
                                                                                                                        3⤵
                                                                                                                          PID:1136
                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                      1⤵
                                                                                                                        PID:480
                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                          2⤵
                                                                                                                          • Adds Run key to start application
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4688
                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{50FBBD3E-56D7-4183-B055-986DD73EEF0A} {AA5FBC6F-1B1B-426D-B1AE-DD5308C9C76B} 4688
                                                                                                                            3⤵
                                                                                                                              PID:2824
                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                          1⤵
                                                                                                                            PID:1028
                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                              2⤵
                                                                                                                              • Adds Run key to start application
                                                                                                                              PID:4944
                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7F7BD156-5886-4244-9FE1-7A995D29505E} {4EF2F79C-EF06-4629-9DEE-E3672F86D0C8} 4944
                                                                                                                                3⤵
                                                                                                                                  PID:3536
                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                              1⤵
                                                                                                                                PID:4400
                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                  2⤵
                                                                                                                                    PID:2768
                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{BD314F2B-9B6A-4C46-8D5C-00E40C271B81} {232FD1E3-C7A3-4833-A327-226C198DE0A7} 2768
                                                                                                                                      3⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1640
                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                  1⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4416
                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                    2⤵
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    PID:352
                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{EF5ADA2C-6CE3-44C5-9AC9-036D8A8C7939} {1365B604-B42B-4589-8DFF-238B2820D655} 352
                                                                                                                                      3⤵
                                                                                                                                        PID:1512
                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                    1⤵
                                                                                                                                      PID:5408
                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                        2⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:4956
                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{F40B5CF6-7D30-48BA-BE60-600248BFEF5A} {23BA41BD-20FE-489C-B87B-EC2C3A8E5B7A} 4956
                                                                                                                                          3⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5556
                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                      1⤵
                                                                                                                                        PID:1124
                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                          2⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3716
                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{4C4443EC-F636-41A4-9FB5-7E84C0D707A8} {C5C4E42E-AA21-4E27-9D59-13A6BCF2333E} 3716
                                                                                                                                            3⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:3024
                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                        1⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2800
                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                          2⤵
                                                                                                                                          • Adds Run key to start application
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2728
                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7611EB29-B71D-41F2-989C-D378269564FB} {32E3272B-0F63-4452-B68C-8D32A40949B5} 2728
                                                                                                                                            3⤵
                                                                                                                                              PID:5508
                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                          1⤵
                                                                                                                                            PID:1860
                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                              2⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4320
                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{7208FCBE-F380-458D-BB53-081BC99E7474} {7F9D79E3-A43F-4CA0-9B7E-8DB0D4E0C850} 4320
                                                                                                                                                3⤵
                                                                                                                                                  PID:4972
                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                              1⤵
                                                                                                                                                PID:1716
                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                  2⤵
                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                  PID:52
                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{F007E6AF-9CE0-4F98-9CF0-0C7EC85C8D76} {4B151137-3986-4DE4-A463-68FEF9E93C9F} 52
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2840
                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                  1⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5928
                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                    2⤵
                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4272
                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{690BC7CA-322B-4593-BBEB-6427D9457562} {C6754495-5253-4D1F-A48F-48D4C624F529} 4272
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5708
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    1⤵
                                                                                                                                                      PID:5556
                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                      1⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4364
                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                        2⤵
                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                        PID:5456
                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5D86F346-931D-4F44-B78D-E55A02ABFCE1} {A243F167-9650-44EE-95E9-B03E3E671BF1} 5456
                                                                                                                                                          3⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5720
                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4256
                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1528
                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{00093258-531C-4CF9-B6BD-51215462A22A} {721709B8-479D-4BE1-A4C0-1EE5513A677B} 1528
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1872
                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3696
                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5768
                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{AEC243DC-AB10-4A97-9AA3-C1510F6B2CB0} {13448365-1124-4F01-98AA-CDBE5918551C} 5768
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3424
                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1400
                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                      PID:2556
                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{87560FA8-74E6-42A5-BE32-71B119108D92} {EBF217D1-9A63-40AB-88B5-18012D8AA1F7} 2556
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3324
                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5740
                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2672
                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{9AB31919-8656-4584-8EAA-293FBACCFD3E} {0D4E9345-CF9C-4B1D-B6B4-C56E5C58E1E9} 2672
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4692
                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5548
                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                PID:2904
                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{4C99D566-65E2-45C4-976C-7B79C55D8D6C} {0E381A03-2BC9-4A84-B50E-1BFA20BFD2D6} 2904
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:6092
                                                                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:856
                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3824
                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                      PID:4708
                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{0971ADA0-16E2-4FD3-A04C-0D4FD6652C14} {7CE4E905-9A05-4968-A47B-A92487A1ADF1} 4708
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2436
                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4972
                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4508
                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{FB3C2F75-C0CF-4821-9E46-3E89DD9B583C} {051FAD79-A07C-4007-8709-1520F35B5B93} 4508
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:596
                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:1652
                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                            PID:4740
                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{E39CF2E4-F3A1-4B35-B303-6AD9A612F56E} {9FED3AAA-18FE-4596-BFBD-402CF19604CF} 4740
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2140
                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5044
                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:6124
                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{3A8DA3CF-0652-41C4-9994-19A8BAA8BCBE} {BCF2C26E-4D08-450F-98D4-7B3BC3760B7B} 3092
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4824
                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{3E78B275-0877-4B4E-92F2-7E293DE2A18B} {F8C4F139-6C6B-4B97-8DD1-87530FDF1504} 4332
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:5676
                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:4656
                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{80D331E4-C9EA-4091-8A86-63EE61DB15E5} {03FBDF81-8DA7-4675-BADB-13CA66816592} 4656
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:2712
                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4652
                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D030A54B-7A8D-4E7D-8F87-377D271BA374} {8229B3DC-3DA3-4955-A7C5-6AC61EF4A02D} 4468
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:356
                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:4144
                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{5F4924D3-36A5-4BD8-B8AE-E3BB0B238B03} {BD848581-E2C7-4C28-BB53-1E388BFDBC76} 3456
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:2592
                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1684
                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{D9D5AB81-2D05-4B5A-9F2E-D284BCE9C64A} {8BFBD137-59D2-4444-9008-BED53127A018} 1684
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5336
                                                                                                                                                                                                                        • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                          "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2708
                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                            PID:5340
                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                              "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{4F440154-E285-4583-A895-ABDD66A29BA4} {CB5C9D68-20C9-44BC-AB12-81BCFD76FAE9} 5340
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                          • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                            "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                              • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:204
                                                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{BBE5AC71-6376-45ED-8297-513D1F805C22} {19DDD8DA-03FD-4C8F-B442-27906F835D12} 204
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1252
                                                                                                                                                                                                                                • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log" /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored /burn.runonce
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                    • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4916
                                                                                                                                                                                                                                      • C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                                                                                                                                                                                                        "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log /passive /norestart ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored ignored -burn.unelevated BurnPipe.{1054472E-0F47-4745-8EB5-C754A7C6EAAC} {3834E5E5-669A-4971-A8BE-33215052E951} 4916
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5252
                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:752
                                                                                                                                                                                                                                      • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                        sihost.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:3500
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:5636
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:1536
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                          PID:6132
                                                                                                                                                                                                                                        • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                                                                                                          \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:2000

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                PowerShell

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1059.001

                                                                                                                                                                                                                                                Windows Command Shell

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1059.003

                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                Active Setup

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1547.014

                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                                                Installer Packages

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1546.016

                                                                                                                                                                                                                                                Power Settings

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1653

                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                Active Setup

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1547.014

                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                Event Triggered Execution

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1546

                                                                                                                                                                                                                                                Installer Packages

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1546.016

                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1562.001

                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                System Binary Proxy Execution

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1218

                                                                                                                                                                                                                                                Msiexec

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1218.007

                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                6
                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                e599ab3.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599ab3.rbs
                                                                                                                                                                                                                                                • Size 73KB
                                                                                                                                                                                                                                                • SHA256 a27960c6d96e0e1e0bf48bbc2a0e45b0252521b2d10fc5f00fc87383dfb8bc5c
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599ab8.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599ab8.rbs
                                                                                                                                                                                                                                                • Size 73KB
                                                                                                                                                                                                                                                • SHA256 7dcd6601e97285b6a0b0688d47311c59fc5b097f781946c0c7e9cffa2b241f80
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599abc.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599abc.rbs
                                                                                                                                                                                                                                                • Size 30KB
                                                                                                                                                                                                                                                • SHA256 0953a4d24b44b2fa40a7a0458b08474ba5dfbaefcfdc5549f1c287c3d30b35bb
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599ac0.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599ac0.rbs
                                                                                                                                                                                                                                                • Size 30KB
                                                                                                                                                                                                                                                • SHA256 f369d9261b8be7daffa2e3129adea701049da6743e6254e98b7962062954e3c3
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599ac4.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599ac4.rbs
                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                • SHA256 f1ad7a95c0175887731702112e9fb38ff0f9441b2b3427a837dec6514389edcb
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599ac8.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599ac8.rbs
                                                                                                                                                                                                                                                • Size 31KB
                                                                                                                                                                                                                                                • SHA256 e9b3c308bafcdcbdd306692a5524c416846edd86345e3d0badada27f04bf8192
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599acc.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599acc.rbs
                                                                                                                                                                                                                                                • Size 17KB
                                                                                                                                                                                                                                                • SHA256 d9fada3b412d637385b65b751814d9dd7b12bfd8854dadaf6ed205232fbebc9d
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599ad5.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599ad5.rbs
                                                                                                                                                                                                                                                • Size 13KB
                                                                                                                                                                                                                                                • SHA256 9d99abf43dd4743b63d16be53df61165151db8e514829861efad362ac371febb
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599adb.rbf
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599adb.rbf
                                                                                                                                                                                                                                                • Size 3B
                                                                                                                                                                                                                                                • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599adf.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599adf.rbs
                                                                                                                                                                                                                                                • Size 18KB
                                                                                                                                                                                                                                                • SHA256 4645e543f078ab371a0207228d652aa3ad957ce3a38a832c258055605d273dfb
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599ae8.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599ae8.rbs
                                                                                                                                                                                                                                                • Size 14KB
                                                                                                                                                                                                                                                • SHA256 25705c5722c4d012a73d509b36e5416c0c194ad4e84fb110c6dc14f8bbf156a9
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599af4.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599af4.rbs
                                                                                                                                                                                                                                                • Size 16KB
                                                                                                                                                                                                                                                • SHA256 73df9d833632812e8205f1f89c7fa9690bd7f4c0177e98d14cf4a275a59aa325
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599af9.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599af9.rbs
                                                                                                                                                                                                                                                • Size 18KB
                                                                                                                                                                                                                                                • SHA256 a292d2c9397266cd25b1aef857c44d1f10675a6429890d767f50ef7b7bfcc821
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599b06.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599b06.rbs
                                                                                                                                                                                                                                                • Size 19KB
                                                                                                                                                                                                                                                • SHA256 10f5d84e9df582eb8554e8df2018da044b84308b4da912a671637c777ddf44c9
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599b17.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599b17.rbs
                                                                                                                                                                                                                                                • Size 20KB
                                                                                                                                                                                                                                                • SHA256 ec01bfc774b00968b4e7c08a91bd57b16adbc87033ed9211d03a0dca87d0a057
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599b26.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599b26.rbs
                                                                                                                                                                                                                                                • Size 19KB
                                                                                                                                                                                                                                                • SHA256 f121dd76bf507cf4b985516d5ff0c5bbe3b73650717aab6969d4bce7f986e1e4
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599b2d.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599b2d.rbs
                                                                                                                                                                                                                                                • Size 20KB
                                                                                                                                                                                                                                                • SHA256 f24e3dde0eb26605333f7d44fa94fe6bd2cb0f819542a8dc5a78daf88bc04825
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                e599b39.rbs
                                                                                                                                                                                                                                                • Path C:\Config.Msi\e599b39.rbs
                                                                                                                                                                                                                                                • Size 19KB
                                                                                                                                                                                                                                                • SHA256 c9ad4219b8f0f53520c024639592c52d32490b43cf81ef921e38f617ab45aadc
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                cab1.cab
                                                                                                                                                                                                                                                • Path C:\ProgramData\Package Cache\{010792BA-551A-3AC0-A7EF-0FAB4156C382}v12.0.40664\packages\vcRuntimeAdditional_amd64\cab1.cab
                                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                                • SHA256 1f2f8f5d60dadbc6e4d3d36c88cc54f22af0a615b609609e748782dc26231174
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                state.rsm
                                                                                                                                                                                                                                                • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                                                                                                                                                                                                                                • Size 622B
                                                                                                                                                                                                                                                • SHA256 cd046bac796925fddb7dab936cccf1e762a6d5567aed28298da9306118ef8aa8
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                state.rsm
                                                                                                                                                                                                                                                • Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\state.rsm
                                                                                                                                                                                                                                                • Size 618B
                                                                                                                                                                                                                                                • SHA256 681e5d2538121181b115f90693cfedccc860571ca0e58277d2997ff73c021fbe
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                cab1.cab
                                                                                                                                                                                                                                                • Path C:\ProgramData\Package Cache\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}v12.0.40664\packages\vcRuntimeMinimum_amd64\cab1.cab
                                                                                                                                                                                                                                                • Size 1010KB
                                                                                                                                                                                                                                                • SHA256 e95d29cbb06bb323d9d43fc2ce61d4565b0866622a83d93df76430a0c252b433
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vc_runtimeMinimum_x86.msi
                                                                                                                                                                                                                                                • Path C:\ProgramData\Package Cache\{8122DAB1-ED4D-3676-BB0A-CA368196543E}v12.0.40664\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi
                                                                                                                                                                                                                                                • Size 140KB
                                                                                                                                                                                                                                                • SHA256 60714fcdac0a7cbfc45e6ed9bc6d4b7f8536947f630016e5faca5cce1745adcf
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                state.rsm
                                                                                                                                                                                                                                                • Path C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm
                                                                                                                                                                                                                                                • Size 618B
                                                                                                                                                                                                                                                • SHA256 79dc343efa7b82b59c16a2a2cee6b6f1d46f28455a78e9b8cf95c5c163df1492
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                • Size 603B
                                                                                                                                                                                                                                                • SHA256 b162cad3e5056ed4fc0b7ea8dcb12c1ef3631852158a72df85c1ec280c90ce97
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                • Size 599B
                                                                                                                                                                                                                                                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                                                                                • Size 562B
                                                                                                                                                                                                                                                • SHA256 2a2e893cf659e7fb79658057731b9c3ad4b4652bb26944c9fad23c147af1707c
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                HFI325D.tmp.html
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\HFI325D.tmp.html
                                                                                                                                                                                                                                                • Size 16KB
                                                                                                                                                                                                                                                • SHA256 e15b024190008f55ca1dd82255427b3e79523be402ad4fd1f32d2d68e75e033a
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                dxwsetup.exe
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
                                                                                                                                                                                                                                                • Size 515KB
                                                                                                                                                                                                                                                • SHA256 8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredis1.cab
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                                                                                                                                                                                                                                • Size 247KB
                                                                                                                                                                                                                                                • SHA256 913ee5a1cae3e5a1872b3a5efaaa00c58e4beb692492b138f76967da671b0477
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredis1.cab
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
                                                                                                                                                                                                                                                • Size 312KB
                                                                                                                                                                                                                                                • SHA256 20a26ed9a1edf7763a9b515522c5e29720048a482c7fbc8b7ff6bbdd27e61038
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredist.msi
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                                                                                                                                                                                                                                • Size 2.6MB
                                                                                                                                                                                                                                                • SHA256 91bdd063f6c53126737791c9eccf0b2f4cf44927831527245bc89a0be06c0cb4
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredist.msi
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi
                                                                                                                                                                                                                                                • Size 3.0MB
                                                                                                                                                                                                                                                • SHA256 200fef5d4994523a02c4daa00060db28eb289b99d47fc6c1305183101e72bdeb
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                VWL2627.tmp
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\VWL2627.tmp
                                                                                                                                                                                                                                                • Size 392B
                                                                                                                                                                                                                                                • SHA256 1958861596b61fa125222f3264d4dcc0729ca80c9ee682fa6a5d98aa80f5ac87
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                VWL2FAC.tmp
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\VWL2FAC.tmp
                                                                                                                                                                                                                                                • Size 392B
                                                                                                                                                                                                                                                • SHA256 dc95b270de03ace167a640c32e262ed0e1b2d0cc123da5e7d74d7f0e8f9f1724
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                __PSScriptPolicyTest_feubmosl.f5x.ps1
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_feubmosl.f5x.ps1
                                                                                                                                                                                                                                                • Size 60B
                                                                                                                                                                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                dd_vcredistMSI2123.txt
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2123.txt
                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                • SHA256 b1d94678465d05a65aefba5d438ffdcc15fadfae6d9c4add32fc468a6c13722e
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                dd_vcredistMSI2129.txt
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI2129.txt
                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                • SHA256 14981c4a10459c29011509316809afedf2f6fb9a94aca1d91a29ba6d2c47458a
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                dd_vcredist_amd64_20261102130154.log
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261102130154.log
                                                                                                                                                                                                                                                • Size 19KB
                                                                                                                                                                                                                                                • SHA256 aae161e4251d9ac19b228fc032a73344be540d1c5f80abc772433fdb03dbeb43
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                dd_vcredist_x86_20261102130152.log
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261102130152.log
                                                                                                                                                                                                                                                • Size 19KB
                                                                                                                                                                                                                                                • SHA256 55724c7f2bcabf90784067acc296a45a188b1bb315cef9d379d9838a342f785f
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                disable-defender.exe
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\disable-defender.exe
                                                                                                                                                                                                                                                • Size 294KB
                                                                                                                                                                                                                                                • SHA256 feb09cc39b1520d228e9e9274500b8c229016d6fc8018a2bf19aa9d3601492c5
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install_all.bat
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\runtimes\install_all.bat
                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                • SHA256 6bb50e82ee3c021fadfb00471d20958d8fc819240c6dab0dcb375ceb64282a70
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredist2005_x64.exe
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2005_x64.exe
                                                                                                                                                                                                                                                • Size 3.0MB
                                                                                                                                                                                                                                                • SHA256 0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredist2005_x86.exe
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2005_x86.exe
                                                                                                                                                                                                                                                • Size 2.6MB
                                                                                                                                                                                                                                                • SHA256 4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredist2008_x64.exe
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2008_x64.exe
                                                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                                                • SHA256 b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredist2008_x86.exe
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\runtimes\vcredist2008_x86.exe
                                                                                                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                                                                                                • SHA256 6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba1\license.rtf
                                                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                                                • SHA256 8518f0420972c1dbe8a323ffc6f57863af0b80c6a3b27fd0c6fc9bdabb7e2d13
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}\.ba2\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Size 5KB
                                                                                                                                                                                                                                                • SHA256 3ae340bec4fb68b477f34dbeadaf8cf3ea95550e427a3bb84994b5806485b5b3
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 ef0085c0476fbe4d6d170c6909f4ad35762fb05e125e9ed707b3c413ae6bbc74
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                logo.png
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba2\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Size 5KB
                                                                                                                                                                                                                                                • SHA256 14266561dedb80c143716c68e0500ac547fa7a5dd9ed23096bb1930c85eddd81
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                wixstdba.dll
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}\.ba2\wixstdba.dll
                                                                                                                                                                                                                                                • Size 117KB
                                                                                                                                                                                                                                                • SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 ed6e836d0ff4648d8464f7f63d2a8f0a10f6fbcee52a92449580d6f7c0238671
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\license.rtf
                                                                                                                                                                                                                                                • Size 47KB
                                                                                                                                                                                                                                                • SHA256 5b7bd9ad76c8df8e2c496b3dcefc9fe3750dccc48fb416126605ed3fb208f55a
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\thm.wxl
                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.xml
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\thm.xml
                                                                                                                                                                                                                                                • Size 5KB
                                                                                                                                                                                                                                                • SHA256 6b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                wixstdba.dll
                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\.ba1\wixstdba.dll
                                                                                                                                                                                                                                                • Size 126KB
                                                                                                                                                                                                                                                • SHA256 7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_msvcp120_x86
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_msvcp120_x86
                                                                                                                                                                                                                                                • Size 444KB
                                                                                                                                                                                                                                                • SHA256 d672fb07a05fb53cc821da0fde823fdfd46071854fe8c6c5ea83d7450b978ecb
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_msvcr120_x86
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_msvcr120_x86
                                                                                                                                                                                                                                                • Size 948KB
                                                                                                                                                                                                                                                • SHA256 e0305aa54823e6f39d847f8b651b7bd08c085f1dbbcb5c3c1ce1942c0fa1e9fa
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_vcamp120_x86
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcamp120_x86
                                                                                                                                                                                                                                                • Size 331KB
                                                                                                                                                                                                                                                • SHA256 c1b61dd24dc2dd5efd5cd548c0cd74fac112358e9e580df4d780d2c125474dad
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_vccorlib120_x86
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vccorlib120_x86
                                                                                                                                                                                                                                                • Size 242KB
                                                                                                                                                                                                                                                • SHA256 1d67a8464991a03fc190d87b43591764f231d7a7a71a72ffc51d982b26691153
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_vcomp120_x86
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\12B8D03ED28D112328CCF0A0D541598E\12.0.40660\F_CENTRAL_vcomp120_x86
                                                                                                                                                                                                                                                • Size 117KB
                                                                                                                                                                                                                                                • SHA256 62287589fc0b577398005f7ac07256d9fe671cdd3e5369faf74b9f64cb572317
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_msvcp120_x64
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcp120_x64
                                                                                                                                                                                                                                                • Size 644KB
                                                                                                                                                                                                                                                • SHA256 92faedd18a29e1bd2dd27a1d805ea5aa3e73b954a625af45a74f49d49506d20f
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_msvcr120_x64
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_msvcr120_x64
                                                                                                                                                                                                                                                • Size 940KB
                                                                                                                                                                                                                                                • SHA256 d28c7ab34842b6149609bd4e6b566ddab8b891f0d5062480a253ef20a6a2caaa
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_vcamp120_x64
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcamp120_x64
                                                                                                                                                                                                                                                • Size 470KB
                                                                                                                                                                                                                                                • SHA256 88a5ed51a7be4ff7ebded0c107fafda6ace3801877216c0bb6cbb458ae054a7b
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_vccorlib120_x64
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vccorlib120_x64
                                                                                                                                                                                                                                                • Size 348KB
                                                                                                                                                                                                                                                • SHA256 1b296bd172332d3b2253bdcb6ecac46afef883f75c13c361632ff40fec743fcc
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                F_CENTRAL_vcomp120_x64
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\$PatchCache$\Managed\CE6380BC270BD863282B3D74B09F7570\12.0.40660\F_CENTRAL_vcomp120_x64
                                                                                                                                                                                                                                                • Size 134KB
                                                                                                                                                                                                                                                • SHA256 22d14e004ba4b78a9143257399dc40ef4d0e8f2cdb9127e1ba2638f54cce5c70
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                MSIA2BE.tmp
                                                                                                                                                                                                                                                • Path C:\Windows\Installer\MSIA2BE.tmp
                                                                                                                                                                                                                                                • Size 28KB
                                                                                                                                                                                                                                                • SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                DirectX.log
                                                                                                                                                                                                                                                • Path C:\Windows\Logs\DirectX.log
                                                                                                                                                                                                                                                • Size 856B
                                                                                                                                                                                                                                                • SHA256 7ecbc3ef191a47f750184d284f7f79f9a11346659cbeaa7afc8708be972c1438
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                VC_redist.x86.exe
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{22CA835F-6764-4A91-B083-36BB22C74F59}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                                                • Size 634KB
                                                                                                                                                                                                                                                • SHA256 d4c6f5c74bbb45c4f33d9cb7ddce47226ea0a5ab90b8ff3f420b63a55c3f6dd2
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{427A4EF7-5C40-44BD-BD84-5537552CA364}\.ba\license.rtf
                                                                                                                                                                                                                                                • Size 9KB
                                                                                                                                                                                                                                                • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.xml
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{427A4EF7-5C40-44BD-BD84-5537552CA364}\.ba\thm.xml
                                                                                                                                                                                                                                                • Size 8KB
                                                                                                                                                                                                                                                • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                VC_redist.x64.exe
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{427A4EF7-5C40-44BD-BD84-5537552CA364}\.be\VC_redist.x64.exe
                                                                                                                                                                                                                                                • Size 635KB
                                                                                                                                                                                                                                                • SHA256 ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D476B6E8-FDB2-4CA5-8096-324CBAD7D1A0}\.ba\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Size 12KB
                                                                                                                                                                                                                                                • SHA256 88effbf5c9eeb280c03fc8e39fdd685f91f0b95842f36fde55db5b759c35d68d
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                wixstdba.dll
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D476B6E8-FDB2-4CA5-8096-324CBAD7D1A0}\.ba\wixstdba.dll
                                                                                                                                                                                                                                                • Size 191KB
                                                                                                                                                                                                                                                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1028\license.rtf
                                                                                                                                                                                                                                                • Size 17KB
                                                                                                                                                                                                                                                • SHA256 44c76290f7a2e45940e8338912feb49bcf4e071cfa85d2d34762857743acbc8d
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1028\thm.wxl
                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                • SHA256 8e2e660dfb66cb453e17f1b6991799678b1c8b350a55f9ebe2ba0028018a15ad
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1029\license.rtf
                                                                                                                                                                                                                                                • Size 12KB
                                                                                                                                                                                                                                                • SHA256 503c433dcde2f3a9e7d388a5ff2b0612e7d8f90f5188d5b2b60228db33044fde
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1029\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 07fb3ec174f25dfbe532d9d739234d9dfda8e9d34f01fe660c5b4d56989fa779
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1031\license.rtf
                                                                                                                                                                                                                                                • Size 12KB
                                                                                                                                                                                                                                                • SHA256 28f63bad9c2960395106011761993049546607f8a850d344d6a54042176bf03f
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1031\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 8e0dca6e085744bfcbff46f7dcbcfa6fbd722dfa52013ee8ceeaf682d7509581
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1036\license.rtf
                                                                                                                                                                                                                                                • Size 12KB
                                                                                                                                                                                                                                                • SHA256 5c13a65870d770d1642a4259eecb436257ca39016a0500f747be9c79be0c7009
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1036\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 704ddf2e60c1f292be95c7c79ee48fe8ba8534ceb7ccf9a9ea68b1ad788ae9d4
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1040\license.rtf
                                                                                                                                                                                                                                                • Size 11KB
                                                                                                                                                                                                                                                • SHA256 70ecf23c03b66a2b18e173332586afa8f00f91e02a80628f4f9cb2521e27f6ac
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1040\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 0c57f40cc2091554307aa8a7c35dd38e4596e9513e9efae00ac30498ef4e9bc2
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1041\license.rtf
                                                                                                                                                                                                                                                • Size 29KB
                                                                                                                                                                                                                                                • SHA256 c3061a334bfd5f02b7085f8f454d5d3d97d477af14bab497bf31a7887bc90c5b
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1041\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 6b9bbf90d75cfa7d943f036c01602945fe2fa786c6173e22acb7afe18375c7ea
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1042\license.rtf
                                                                                                                                                                                                                                                • Size 27KB
                                                                                                                                                                                                                                                • SHA256 3d4e9c165cbeab829d608106f0e96450f839ffa8adbd755f0b51867e89da2ae0
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1042\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 ad7608b87a7135f408abf54a897a0f0920080f76013314b00d301d6264ae90b2
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1045\license.rtf
                                                                                                                                                                                                                                                • Size 13KB
                                                                                                                                                                                                                                                • SHA256 6f94a99072061012c5626a6dd069809ec841d6e3102b48394d522a0c2e3aa2b5
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1045\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 440b309fcdf61ffc03b269fe3815c60cb52c6ae3fc6acad14eac04d057b6d6ea
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1046\license.rtf
                                                                                                                                                                                                                                                • Size 10KB
                                                                                                                                                                                                                                                • SHA256 27891eec899be859e3b4d3b29247fc6b535d7e836def0329111c48741ec6e701
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1046\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 f52b54a0e0d0e8f12cba9823d88e9fd6822b669074dd1dc69dad6553f7cb8913
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1049\license.rtf
                                                                                                                                                                                                                                                • Size 31KB
                                                                                                                                                                                                                                                • SHA256 1bb3fb55b8a13fa3bafffe72f5b1ed8b57a63bd4d8654bb6dc5b9011ce803b44
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1049\thm.wxl
                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                • SHA256 7333bc8e52548821d82b53dbd7d7c4aa1703c85155480cb83cefd78380c95661
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1055\license.rtf
                                                                                                                                                                                                                                                • Size 13KB
                                                                                                                                                                                                                                                • SHA256 f80926604e503697247353f56856b31de0b3fc1319f1c94068363952549cc9b1
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\1055\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 e5abe3cb3bf84207dac4e6f5bba1e693341d01aea076dd2d91eaa21c6a6cb925
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\2052\license.rtf
                                                                                                                                                                                                                                                • Size 17KB
                                                                                                                                                                                                                                                • SHA256 a808b4933ce3b3e0893504dbef43ebf90b8b567f94bd6481b6315ed9141e1b11
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\2052\thm.wxl
                                                                                                                                                                                                                                                • Size 2KB
                                                                                                                                                                                                                                                • SHA256 2ac8b7c19a5189662de36a0581c90dbad96df259ec00a28f609b644c3f39f9ca
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                license.rtf
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\3082\license.rtf
                                                                                                                                                                                                                                                • Size 10KB
                                                                                                                                                                                                                                                • SHA256 abc11bb2b04dff6afe2d4d4f40d95a7d62e5af352928af90daa3dade58dd59bd
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                thm.wxl
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\3082\thm.wxl
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 9cbb2b312c100b309a1b1495e84e2228b937612885f7a642fbbd67969b632c3a
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Path C:\Windows\Temp\{D96D27A3-505B-414C-B8BC-46EC120257B0}\.ba\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                                • Size 14KB
                                                                                                                                                                                                                                                • SHA256 0e5d6ce30f863a00cc2032182a5553d30c175af03815ad1ff1f0e1f7b92f8163
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.exe
                                                                                                                                                                                                                                                • Path F:\805606d076b3f12830\install.exe
                                                                                                                                                                                                                                                • Size 547KB
                                                                                                                                                                                                                                                • SHA256 b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1033.dll
                                                                                                                                                                                                                                                • Path F:\805606d076b3f12830\install.res.1033.dll
                                                                                                                                                                                                                                                • Size 85KB
                                                                                                                                                                                                                                                • SHA256 a522c5ea3250cdd538a9ce7b4a06dfd5123e7eb05eef67509f2b975a8e1d3067
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                $shtdwn$.req
                                                                                                                                                                                                                                                • Path F:\87d44e472a5808b4a99ddff3f5a2c000\$shtdwn$.req
                                                                                                                                                                                                                                                • Size 788B
                                                                                                                                                                                                                                                • SHA256 3c418a401cbe09f64ede6e598c5ca36717830446147c8ef6327168edc7b1cb0c
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                Setup.exe
                                                                                                                                                                                                                                                • Path F:\87d44e472a5808b4a99ddff3f5a2c000\Setup.exe
                                                                                                                                                                                                                                                • Size 76KB
                                                                                                                                                                                                                                                • SHA256 531eb45798728cb741043b28b8c1a4f75536dc75f92d100f55f9109d2d63f0d7
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                UiInfo.xml
                                                                                                                                                                                                                                                • Path F:\87d44e472a5808b4a99ddff3f5a2c000\UiInfo.xml
                                                                                                                                                                                                                                                • Size 35KB
                                                                                                                                                                                                                                                • SHA256 66a0299ce7ee12dd9fc2cfead3c3211e59bfb54d6c0627d044d44cef6e70367b
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.exe
                                                                                                                                                                                                                                                • Path F:\a1d2d608c88aaace2684\install.exe
                                                                                                                                                                                                                                                • Size 834KB
                                                                                                                                                                                                                                                • SHA256 f0110ab02e8a531e3e7d196c03f907c659e6262c75861dc0c8d05f6a3ccbdd6b
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1033.dll
                                                                                                                                                                                                                                                • Path F:\a1d2d608c88aaace2684\install.res.1033.dll
                                                                                                                                                                                                                                                • Size 84KB
                                                                                                                                                                                                                                                • SHA256 6ad479dd35201c74092068cccd6d12fd84a45d2c04e927b39901a9126f9e06dd
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                metadata-2
                                                                                                                                                                                                                                                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                                                                                                                                                                                • Size 26.1MB
                                                                                                                                                                                                                                                • SHA256 c03cb5b99ad5cf81012e789b0b3c7441939927bccaa1c49b367876b1459c176f
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                {aaddaeb2-ece3-4ab2-900e-a26872622fd9}_OnDiskSnapshotProp
                                                                                                                                                                                                                                                • Path \??\Volume{804c0bee-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{aaddaeb2-ece3-4ab2-900e-a26872622fd9}_OnDiskSnapshotProp
                                                                                                                                                                                                                                                • Size 6KB
                                                                                                                                                                                                                                                • SHA256 5c5a821b80013d4ca65bdba7ea77aca6be771d6d92b0e70c931e41a598fdf14d
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                VC_RED.cab
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\VC_RED.cab
                                                                                                                                                                                                                                                • Size 3.7MB
                                                                                                                                                                                                                                                • SHA256 461d575bc1a07f64c14f1da885d2f310bd282cbbedcd0a5cf8ffa7057411805d
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1028.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1028.txt
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1031.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1031.txt
                                                                                                                                                                                                                                                • Size 15KB
                                                                                                                                                                                                                                                • SHA256 3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1033.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1033.txt
                                                                                                                                                                                                                                                • Size 9KB
                                                                                                                                                                                                                                                • SHA256 c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1036.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1036.txt
                                                                                                                                                                                                                                                • Size 11KB
                                                                                                                                                                                                                                                • SHA256 3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1040.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1040.txt
                                                                                                                                                                                                                                                • Size 13KB
                                                                                                                                                                                                                                                • SHA256 ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1041.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1041.txt
                                                                                                                                                                                                                                                • Size 5KB
                                                                                                                                                                                                                                                • SHA256 467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1042.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1042.txt
                                                                                                                                                                                                                                                • Size 5KB
                                                                                                                                                                                                                                                • SHA256 3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.1049.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.1049.txt
                                                                                                                                                                                                                                                • Size 13KB
                                                                                                                                                                                                                                                • SHA256 f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.2052.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.2052.txt
                                                                                                                                                                                                                                                • Size 3KB
                                                                                                                                                                                                                                                • SHA256 744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                eula.3082.txt
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\eula.3082.txt
                                                                                                                                                                                                                                                • Size 12KB
                                                                                                                                                                                                                                                • SHA256 c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                globdata.ini
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\globdata.ini
                                                                                                                                                                                                                                                • Size 1KB
                                                                                                                                                                                                                                                • SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.ini
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.ini
                                                                                                                                                                                                                                                • Size 841B
                                                                                                                                                                                                                                                • SHA256 c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1028.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.1028.dll
                                                                                                                                                                                                                                                • Size 71KB
                                                                                                                                                                                                                                                • SHA256 1074252f76e72e59a9da9d7e109c80ab131d53554c49cb3d69a180729bffc18e
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1031.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.1031.dll
                                                                                                                                                                                                                                                • Size 90KB
                                                                                                                                                                                                                                                • SHA256 2c5fa53e6eb07bddc22c7c5203ff7bbe707c4cf8803f144ceb031384b59831aa
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1036.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.1036.dll
                                                                                                                                                                                                                                                • Size 91KB
                                                                                                                                                                                                                                                • SHA256 cb38381c0afdcb3465f71699addad7534ffd72702907b017708eba463dbc68b6
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1040.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.1040.dll
                                                                                                                                                                                                                                                • Size 89KB
                                                                                                                                                                                                                                                • SHA256 709ab0139c643b78c2dace7a35b9801e1a4b4e4c4e176c0d00f1b55a2a71d7a8
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1041.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.1041.dll
                                                                                                                                                                                                                                                • Size 76KB
                                                                                                                                                                                                                                                • SHA256 f74006aaa2a19777fb0c3b81321aabf00d87107dc23ba0d2282092502e5cd332
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1042.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.1042.dll
                                                                                                                                                                                                                                                • Size 74KB
                                                                                                                                                                                                                                                • SHA256 16fed8f279b0240f63dd90925150cd37782e9395af32a2693bdc0533c0809767
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1049.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.1049.dll
                                                                                                                                                                                                                                                • Size 87KB
                                                                                                                                                                                                                                                • SHA256 3de25f7b3fd91a8d5b7f7dd8eccf44e24b33b66133fc89519d21a426b489374e
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.2052.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.2052.dll
                                                                                                                                                                                                                                                • Size 70KB
                                                                                                                                                                                                                                                • SHA256 f6d949f493cb9b1ba5ee053acc7363bc9675b9e8b3f25258080092001036e6f4
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.3082.dll
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\install.res.3082.dll
                                                                                                                                                                                                                                                • Size 90KB
                                                                                                                                                                                                                                                • SHA256 8de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vc_red.msi
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\vc_red.msi
                                                                                                                                                                                                                                                • Size 222KB
                                                                                                                                                                                                                                                • SHA256 34c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vcredist.bmp
                                                                                                                                                                                                                                                • Path \??\f:\805606d076b3f12830\vcredist.bmp
                                                                                                                                                                                                                                                • Size 5KB
                                                                                                                                                                                                                                                • SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                install.res.1042.dll
                                                                                                                                                                                                                                                • Path \??\f:\a1d2d608c88aaace2684\install.res.1042.dll
                                                                                                                                                                                                                                                • Size 73KB
                                                                                                                                                                                                                                                • SHA256 05e79bf81fe87ba3db89950cea02ae78e3b7b1c2d6575f19df47c4f5d7888566
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                vc_red.msi
                                                                                                                                                                                                                                                • Path \??\f:\a1d2d608c88aaace2684\vc_red.msi
                                                                                                                                                                                                                                                • Size 230KB
                                                                                                                                                                                                                                                • SHA256 017e62a7a046acf00f5565e60f8eed4c5f409913e7ddc2f431d4236bbfdabab8
                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                memory/1536-2901-0x0000020D95000000-0x0000020D95434000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/3508-5-0x000001D3FFC40000-0x000001D3FFC62000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/6132-2727-0x0000021E001E0000-0x0000021E002E0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/6132-2779-0x0000021E14280000-0x0000021E142A0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/6132-2746-0x0000021E13EF0000-0x0000021E13FF0000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/6132-2756-0x0000021E03DF0000-0x0000021E03E10000-memory.dmp
                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                memory/6132-2745-0x0000021E03D10000-0x0000021E03D30000-memory.dmp
                                                                                                                                                                                                                                                Download