Malwagon
EXE
Setup_BrightSlide_1.1.2.exe File Analysis · first seen Oct 13, 2026 17:18 · 12.5 MB
5proc 32files 267reg 1drops 6IOCs
Nothing conclusive12 Completed Public
Get sample Report Sign in

Setup_BrightSlide_1.1.2.exePE analysis report - Nothing conclusive

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

38.4sto launch
869telemetry events
373observed
47agent notes

Nothing conclusive

12/100

23 points short of the suspicious line at 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+34
Runtime behavior
  • 2 evasion behavior(s)
  • Dropped an executable to disk (+1 more runtime behavior)
+25
Static analysis
  • Packed (Inno Setup, confidence 61)
  • 1 high-risk capability(ies): token manipulation
  • 1 high-risk capability bucket(s): Privilege escalation
+8
Persistence
  • 1 persistence mechanism(s): Office Add-in
+0
Model review
  • findings review (advisory, not scored): suspicious - dropped executable, office add-in persistence, timestomping, anti-debug checks
-55
Code signing
  • Valid code signature (BrightCarbon Inc.) - trusted provenance; heuristic score discounted below malicious (no definitive malicious evidence)

Model reading

Measured CLEAN12 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score
Dynamic ran moved the score
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution107s (ended early)
Guest hardware2 vCPU4095 MB RAM

Detection signatures

16 detected · 5 withheld as common
Severity Detection Evidence Layer
MED
Creates a suspended process then resumes (hollowing/hijack)
MITRE T1055.012
import kernel32.dll!CreateProcessW requires createprocess
import kernel32.dll!ResumeThread requires resumethread
static
MED
Dropped an executable to disk
MITRE T1105
file C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\BrightSlide Assets.msi dropped
dynamic
MED
Evasion: anti debug
MITRE T1497
runtime anti debug evasion signal
dynamic
MED
Evasion: anti vm
MITRE T1497
runtime anti vm evasion signal
dynamic
MED
Executes external code / commands
MITRE T1059
confirmed at runtime, seen in 30% of benign software statically
capability createprocessw capability: execution
capability createthread capability: execution
capability system capability: execution
static
MED
Forces reboot/shutdown (post-impact)
MITRE T1529
import user32.dll!ExitWindowsEx
static
MED
Packed with Inno Setup
MITRE T1027.002
packer Inno Setup packer identification
entropy 7.98 file entropy (8.0 = random)
static
MED
TLS callback (pre-main execution)
MITRE T1055
pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point
static
MED
Timestomping
runtime timestomping observed in the guest
dynamic
LOW
Adjusts token privileges (SeDebug / escalation)
MITRE T1134
seen in 8% of benign software
import advapi32.dll!AdjustTokenPrivileges
static
LOW
Checks free disk space (sandbox sizing check)
MITRE T1497.001
seen in 6% of benign software
import kernel32.dll!GetDiskFreeSpaceW
static
LOW
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
import kernel32.dll!VirtualProtect requires virtualprotect
import kernel32.dll!VirtualAlloc requires virtualalloc
static
LOW
Queries system information (host recon)
MITRE T1082
confirmed at runtime, seen in 25% of benign software statically
import kernel32.dll!GetSystemInfo
static
LOW
Reflective/manual DLL load pattern
MITRE T1620
seen in 8% of benign software
import kernel32.dll!VirtualAlloc requires virtualalloc
import kernel32.dll!GetProcAddress requires getprocaddress
import kernel32.dll!LoadLibraryA requires loadlibrary
import kernel32.dll!CreateThread requires createthread
static
LOW
Scans memory layout (VirtualQuery)
MITRE T1055
import kernel32.dll!VirtualQueryEx
static
LOW
Spawns child processes
MITRE T1106
seen in 16% of benign software
import kernel32.dll!CreateProcessW
static
Withheld: 5 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
Dynamic API resolution (obfuscation) fires on 65% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Reads its own startup info (parent/desktop check) fires on 36% of benign software
Queries system information (host recon) fires on 25% of benign software

Persistence

1 mechanism
MED
Office Add-in runtime
Scripting & Applications · MITRE T1137.006

Auto-start methods established during detonation or referenced statically. The Persistence tab lists these against every method checked.

What the tests returned

5 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Cross-process injectionnone observed
Network connectionsnot tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The file carries a code signature (BrightCarbon Inc.).
  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Confirmed. Independent external evidence, or the same behaviour seen by more than one analysis layer. The one fact that decided it: several independent runtime observations.

Instrument coverage

1 of 2 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch measured Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
Network capture not on this plan Not included on this scan's plan.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Inno Setup Module(6.1.0)[unicode]
Packed Trusted signature
CompilerEmbarcadero Delphi(10.3 Rio)[Professional]
LinkerTurbo Linker(2.25*,Delphi)[GUI32,signed]
InstallerInno Setup Module(6.1.0)[unicode]
Identity
File
typeexecutable
size12.5 MB
file arch32-bit (x86)
subsystemGUI
entropy7.978
date2023-02-15 14:54:16 UTC
version
descriptionBrightSlide Setup
productBrightSlide
languageEN, NEU

Antivirus engine

no signature matched signature set 28152 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28152
Signatures in the set3,642,870
Set published13 Oct 2026 06:26 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

14.6 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 14.6 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural featureWhat it meansPushesWeight
countersigned at When a timestamp authority countersigned the signature (1779805056) towards benign -1.2223
security directory size Size of the security table (12120) towards benign -0.8334
certificate chain length How many certificates the chain holds (3) towards benign -0.6982
image flag dll Image flag: a library rather than a program towards malicious +0.6656
parser warning: Suspicious flags set for section... Header defect reported by the parse: Suspicious flags set for section... (0) towards benign -0.4006
feature column 991 Size of the data appended after the last section towards malicious +0.3007
countersigned minus build timestamp Gap between the build date and the countersignature (103332192) towards benign -0.2670
optional.checksum Header checksum, which is zero on most files that were never signed (13119825) towards benign -0.2656

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing
Packed with Inno Setup
Packed code is compressed or encrypted on disk and only appears once the sample runs.
installer
61/100
packer confidence
Detonation is the reliable read here A packed file hides its behaviour from a static pass, so the verdict leans on what it does when it runs.
Evidence 4 signals
  • Packer section '.didata' (Inno Setup)
  • High-entropy resource (possible packed payload)
  • Marker 'Inno Setup' (Inno Setup)
  • TLS callback present

Family configuration search

Incomplete

3 of this platform's 71 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available71
Returned a result4
Failed to decode3

Capabilities

7 behaviour buckets · 1 high-risk
SeverityCapabilityMITREAPIs
high Privilege escalation
Adjusts tokens / privileges
 T1134, T1134.001 adjusttokenprivileges, openprocesstoken
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress, loadlibrarya, loadlibraryw
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497.003 gettickcount, queryperformancecounter, sleep
med Code execution
Creates processes / runs commands or shellcode
 T1059, T1106 createprocessw, createthread, system
med Ransomware behaviour
Enumerates + encrypts files, deletes backups
 T1083 findfirstfilew
med System shutdown / reboot
Reboots or shuts down the host
 T1529 exitwindowsex
low Discovery
Enumerates the host, users, processes or network
 T1082 getsysteminfo, netwkstagetinfo

Security mitigations

partial posture
ON ASLR (DynamicBase)
OFF High-entropy ASLR (64-bit)
ON DEP / NX (NxCompat)
OFF Control Flow Guard
? SafeSEH
? Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Sections

10 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.text
Executable code
 0x1000
718.5 KB
718.5 KB
EXECUTEREAD
6.3576
.itextEP
Initialisation code
 0xb5000
6.0 KB
5.6 KB
EXECUTEREAD
5.9714
.data
Initialised data
 0xb7000
14.0 KB
13.9 KB
READWRITE
5.0486
.bss
Uninitialised data
 0xbb000
0.0 B
27.5 KB
READWRITE
0.0
.idata
Import table
 0xc2000
4.0 KB
4.0 KB
READWRITE
5.0291
.didata
Non-standard section
 0xc3000
512.0 B
420.0 B
READWRITE
2.751
.edata
Export table
 0xc4000
512.0 B
154.0 B
READ
1.8772
.tls
Thread-local storage
 0xc5000
0.0 B
24.0 B
READWRITE
0.0
.rdata
Read-only data
 0xc6000
512.0 B
93.0 B
READ
1.3839
.rsrc
Resources
 0xc7000
109.0 KB
108.8 KB
READ
4.442
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

142 funcs / 7 DLLs · 13 suspicious
▸kernel32.dll100 funcs 10 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetACP 0x000c22f4 - -
GetExitCodeProcess 0x000c22f8 - -
LocalFree 0x000c22fc - -
CloseHandle 0x000c2300 - -
SizeofResource 0x000c2304 - -
VirtualProtect 0x000c2308 - T1055
VirtualFree 0x000c230c - -
GetFullPathNameW 0x000c2310 - -
ExitProcess 0x000c2314 - -
HeapAlloc 0x000c2318 - -
GetCPInfoExW 0x000c231c - -
RtlUnwind 0x000c2320 yes -
GetCPInfo 0x000c2324 - -
GetStdHandle 0x000c2328 - -
GetModuleHandleW 0x000c232c - -
FreeLibrary 0x000c2330 - -
HeapDestroy 0x000c2334 - -
ReadFile 0x000c2338 - -
CreateProcessW 0x000c233c - T1106
GetLastError 0x000c2340 - -
GetModuleFileNameW 0x000c2344 - -
SetLastError 0x000c2348 - -
FindResourceW 0x000c234c - -
CreateThread 0x000c2350 - -
CompareStringW 0x000c2354 - -
LoadLibraryA 0x000c2358 - T1129
ResetEvent 0x000c235c - -
GetVersion 0x000c2360 - -
RaiseException 0x000c2364 - -
FormatMessageW 0x000c2368 - -
SwitchToThread 0x000c236c - -
GetExitCodeThread 0x000c2370 - -
GetCurrentThread 0x000c2374 - -
LoadLibraryExW 0x000c2378 - -
LockResource 0x000c237c - -
GetCurrentThreadId 0x000c2380 - -
UnhandledExceptionFilter 0x000c2384 - -
VirtualQuery 0x000c2388 - -
VirtualQueryEx 0x000c238c - -
Sleep 0x000c2390 - -
EnterCriticalSection 0x000c2394 - -
SetFilePointer 0x000c2398 - -
LoadResource 0x000c239c - T1129
SuspendThread 0x000c23a0 - -
GetTickCount 0x000c23a4 - T1497
GetFileSize 0x000c23a8 - -
GetStartupInfoW 0x000c23ac - -
GetFileAttributesW 0x000c23b0 - -
InitializeCriticalSection 0x000c23b4 - -
GetSystemWindowsDirectoryW 0x000c23b8 - -
GetThreadPriority 0x000c23bc - -
SetThreadPriority 0x000c23c0 - -
GetCurrentProcess 0x000c23c4 - -
VirtualAlloc 0x000c23c8 - T1055
GetSystemInfo 0x000c23cc - -
GetCommandLineW 0x000c23d0 - -
LeaveCriticalSection 0x000c23d4 - -
GetProcAddress 0x000c23d8 - T1129
ResumeThread 0x000c23dc - -
GetVersionExW 0x000c23e0 - -
VerifyVersionInfoW 0x000c23e4 - -
HeapCreate 0x000c23e8 - -
GetWindowsDirectoryW 0x000c23ec - -
VerSetConditionMask 0x000c23f0 - -
GetDiskFreeSpaceW 0x000c23f4 - -
FindFirstFileW 0x000c23f8 - T1083
GetUserDefaultUILanguage 0x000c23fc - -
lstrlenW 0x000c2400 - -
QueryPerformanceCounter 0x000c2404 - T1497
SetEndOfFile 0x000c2408 - -
HeapFree 0x000c240c - -
WideCharToMultiByte 0x000c2410 - -
FindClose 0x000c2414 - -
MultiByteToWideChar 0x000c2418 - -
LoadLibraryW 0x000c241c - T1129
SetEvent 0x000c2420 - -
CreateFileW 0x000c2424 - -
GetLocaleInfoW 0x000c2428 - -
GetSystemDirectoryW 0x000c242c - -
DeleteFileW 0x000c2430 - -
GetLocalTime 0x000c2434 - -
GetEnvironmentVariableW 0x000c2438 - -
WaitForSingleObject 0x000c243c - -
WriteFile 0x000c2440 - -
ExitThread 0x000c2444 - -
DeleteCriticalSection 0x000c2448 - -
TlsGetValue 0x000c244c - -
GetDateFormatW 0x000c2450 - -
SetErrorMode 0x000c2454 - -
IsValidLocale 0x000c2458 - -
TlsSetValue 0x000c245c - -
CreateDirectoryW 0x000c2460 - -
GetSystemDefaultUILanguage 0x000c2464 - -
EnumCalendarInfoW 0x000c2468 - -
LocalAlloc 0x000c246c - -
GetUserDefaultLangID 0x000c2470 - -
RemoveDirectoryW 0x000c2474 - -
CreateEventW 0x000c2478 - -
SetThreadLocale 0x000c247c - -
GetThreadLocale 0x000c2480 - -
▸comctl32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
InitCommonControls 0x000c2488 - -
▸version.dll3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetFileVersionInfoSizeW 0x000c2490 - -
VerQueryValueW 0x000c2494 - -
GetFileVersionInfoW 0x000c2498 - -
▸user32.dll16 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
CreateWindowExW 0x000c24a0 - -
TranslateMessage 0x000c24a4 - -
CharLowerBuffW 0x000c24a8 - -
CallWindowProcW 0x000c24ac - -
CharUpperW 0x000c24b0 - -
PeekMessageW 0x000c24b4 - -
GetSystemMetrics 0x000c24b8 - -
SetWindowLongW 0x000c24bc - -
MessageBoxW 0x000c24c0 - -
DestroyWindow 0x000c24c4 - -
CharUpperBuffW 0x000c24c8 - -
CharNextW 0x000c24cc - -
MsgWaitForMultipleObjects 0x000c24d0 - -
LoadStringW 0x000c24d4 - -
ExitWindowsEx 0x000c24d8 - -
DispatchMessageW 0x000c24dc - -
▸oleaut32.dll11 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
SysAllocStringLen 0x000c24e4 - -
SafeArrayPtrOfIndex 0x000c24e8 - -
VariantCopy 0x000c24ec - -
SafeArrayGetLBound 0x000c24f0 - -
SafeArrayGetUBound 0x000c24f4 - -
VariantInit 0x000c24f8 - -
VariantClear 0x000c24fc - -
SysFreeString 0x000c2500 - -
SysReAllocStringLen 0x000c2504 - -
VariantChangeType 0x000c2508 - -
SafeArrayCreate 0x000c250c - -
▸netapi32.dll2 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
NetWkstaGetInfo 0x000c2514 - -
NetApiBufferFree 0x000c2518 - -
▸advapi32.dll9 funcs 3 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
ConvertStringSecurityDescriptorToSecurityDescriptorW 0x000c2520 - -
RegQueryValueExW 0x000c2524 - -
AdjustTokenPrivileges 0x000c2528 - T1134
GetTokenInformation 0x000c252c - -
ConvertSidToStringSidW 0x000c2530 - -
LookupPrivilegeValueW 0x000c2534 - T1134
RegCloseKey 0x000c2538 - -
OpenProcessToken 0x000c253c - T1134
RegOpenKeyExW 0x000c2540 - -

Binary metadata

what the headers declare about this build
Resource langsENNEU
Debug infono
TLS callbacksyes

Code signing

Trusted signature
BrightCarbon Inc.
issued by Sectigo Public Code Signing CA EV R36
Signed byBrightCarbon Inc.
Issuer (CA)Sectigo Public Code Signing CA EV R36
Valid2025-07-18 → 2028-07-17
Serial0096ef356e82a162338347b57df93a04aa
AlgorithmSHA256-RSA
Verification
Embedded signature: OK
Chain verification: not verified
Provenance
The chain verifies as of now, so these bytes are attributable to the publisher above.
Signed at 2026-05-26T14:17:31+00:00 proven
Countersigned by Sectigo Public Time Stamping Signer R36 under Sectigo Public Time Stamping Root R46
Countersignature form RFC3161 token a signed structure issued by the timestamp authority, which is the stronger of the two forms and the one preferred here when a file carries both
Authority revocation unanswered no definite revocation answer was obtained for this authority's own chain
Dated by This platform's own verification of the countersignature - the same reading that proves it, so the moment the chain is judged at and the proof of that moment are one thing.
Second reading 2026-05-26T14:17:31+00:00 agrees with ours
Second opinion failed an independent verifier's separate answer about the same countersignature, kept so the two can be compared
Certificate chain (3)
SubjectIssuerValid toAlgo
Sectigo Public Code Signing Root … AAA Certificate Services 2028-12-31 SHA384-RSA
Sectigo Public Code Signing CA EV… Sectigo Public Code Signing Root … 2036-03-21 SHA384-RSA
BrightCarbon Inc. Sectigo Public Code Signing CA EV… 2028-07-17 SHA256-RSA

Similar samples

4 related samples

Ranked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.

RelationSampleVerdictWhy it matched
related INSIDE_V2.0.0_Windows_Installer… Malicious identical import table (imphash) · identical export table (exphash)
related fsrdemoing.exe Suspicious identical export table (exphash)
related AutoFishing.exe Suspicious identical export table (exphash)
related afterpatch.exe No threats detected identical export table (exphash)

Capability detection

49 capabilities
list is incomplete here

The capability analysis reports that this file is an installer, so the capabilities below are mostly its installer stub's, not the payload's.

Read what follows as the capabilities of the code that could be read, not of the file as a whole.

CapabilityNamespace
link function at runtime on Windows linking/runtime-linking
calculate modulo 256 via x86 assembly -
create or open file -
modify access privileges host-interaction/process/modify
create process on Windows host-interaction/process/create
allocate memory -
allocate or change RW memory -
delay execution -
generate random numbers using the Delphi LCG data-manipulation/prng/lcg
create thread host-interaction/thread/create
create or open registry key -
get file attributes host-interaction/file-system/meta
encode data using XOR data-manipulation/encoding/xor
PEB access -
suspend thread host-interaction/thread/suspend
create process suspended host-interaction/process/create
change memory protection -
allocate or change RWX memory host-interaction/process/inject
contain loop -
write file on Windows host-interaction/file-system/write
check for time delay via GetTickCount anti-analysis/anti-debugging/debugger-detection
terminate process host-interaction/process/terminate
get OS version -
check OS version host-interaction/os/version
get geographical location collection
identify system language via API targeting/language
query or enumerate registry value host-interaction/registry
get system information on Windows host-interaction/os/info
set thread local storage value host-interaction/thread/tls
get thread local storage value host-interaction/process
get common file path host-interaction/file-system
encrypt data using RC4 PRGA data-manipulation/encryption/rc4
get disk size host-interaction/hardware/storage
get file version info host-interaction/file-system/meta
query environment variable host-interaction/environment-variable
accept command line arguments host-interaction/cli
clear file content host-interaction/file-system/write
hash data with CRC32 data-manipulation/checksum/crc32
delete file host-interaction/file-system/delete
create directory host-interaction/file-system/create
shutdown system host-interaction/os
check if file exists host-interaction/file-system/exists
extract resource via kernel32 functions executable/resource
delete directory host-interaction/file-system/delete
reference analysis tools strings anti-analysis
compiled with Borland Delphi compiler/delphi
packaged as an Inno Setup installer executable/installer/inno-setup
contain a thread local storage (.tls) section executable/pe/section/tls
ATT&CK techniques
Defense Evasion::Obfuscated Files or Information [T1027]Discovery::File and Directory Discovery [T1083]Discovery::Query Registry [T1012]Discovery::System Information Discovery [T1082]Discovery::System Location Discovery [T1614]Discovery::System Location Discovery::System Language Discovery [T1614.001]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]Impact::System Shutdown/Reboot [T1529]Privilege Escalation::Access Token Manipulation [T1134]
Malware Behavior Catalog
Anti-Behavioral Analysis::Debugger Detection::Process Environment BlockAnti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCountAnti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionCryptography::Encrypt Data::RC4Cryptography::Generate Pseudo-random SequenceCryptography::Generate Pseudo-random Sequence::RC4 PRGAData::Checksum::CRC32Data::Encode Data::XORData::ModuloDefense Evasion::Obfuscated Files or Information::Encoding-Standard AlgorithmDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create DirectoryFile System::Create FileFile System::Delete DirectoryFile System::Delete FileFile System::Get File AttributesFile System::Writes FileMemory::Allocate MemoryMemory::Change Memory ProtectionOperating System::Registry::Create Registry KeyOperating System::Registry::Open Registry KeyOperating System::Registry::Query Registry ValueProcess::Create ProcessProcess::Create Process::Create Suspended ProcessProcess::Create ThreadProcess::Set Thread Local Storage ValueProcess::Suspend ThreadProcess::Terminate Process

Signature matches

0 findings · 5 file properties · 0 scored
File properties
IsPE32IsWindowsGUIIsPackedHasOverlayborland_delphi

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

No signature rule identified a threat in this file.

Extracted strings

showing 200 of 3513
  • This program must be run under Win32
  • .text
  • `.itext
  • `.data
  • .bss
  • .idata
  • .didata
  • .edata
  • @.tls
  • .rdata
  • @.rsrc
  • Boolean
  • False
  • True
  • System
  • AnsiChar
  • Char
  • ShortInt
  • SmallInt
  • Integer
  • Byte
  • Word
  • Cardinal
  • Pointer
  • UInt64
  • NativeInt
  • NativeUInt
  • Single
  • Extended
  • Double
  • Comp
  • Currency
  • ShortString
  • PAnsiChar0
  • PWideCharL
  • ByteBool
  • WordBool
  • LongBool
  • string
  • WideString
  • AnsiString
  • Variant
  • OleVariant
  • TClass
  • HRESULT
  • TGUID
  • &op_Equality
  • Left
  • Right
  • &op_Inequality
  • Create
  • Data
  • BigEndian
  • AStartIndex
  • PInterfaceEntry
  • TInterfaceEntry
  • VTable
  • IOffset
  • ImplGetter
  • PInterfaceTable4
  • TInterfaceTable
  • EntryCount
  • Entries
  • TMethod
  • Code
  • &op_GreaterThan
  • &op_GreaterThanOrEqual
  • &op_LessThan
  • &op_LessThanOrEqual
  • TObject&
  • Self
  • Free
  • DisposeOf
  • InitInstance
  • Instance
  • CleanupInstance
  • ClassType
  • ClassName
  • ClassNameIs
  • Name
  • ClassParent
  • ClassInfo
  • InstanceSize
  • InheritsFrom
  • AClass
  • MethodAddress
  • MethodName
  • Address
  • QualifiedClassName
  • FieldAddress
  • GetInterface
  • GetInterfaceEntry
  • GetInterfaceTable
  • UnitName
  • UnitScope
  • GetHashCode
  • ToString
  • SafeCallException
  • ExceptObject
  • ExceptAddr
  • AfterConstruction
  • BeforeDestruction
  • Dispatch
  • Message
  • DefaultHandler
  • NewInstance
  • FreeInstance
  • Destroy
  • TObjecth
  • TCustomAttribute
  • WeakAttribute
  • UnsafeAttribute
  • UnsafeAttribute@!@
  • VolatileAttribute
  • HPPGENAttribute5
  • AData
  • AFlag
  • HPPGENAttribute
  • PMonitorT$@
  • TMonitor.PWaitingThread
  • TMonitor.TWaitingThread
  • Next
  • Thread
  • WaitEvent
  • TMonitor.TSpinLock
  • Enter
  • Exit
  • TMonitor
  • FLockCount
  • FRecursionCount
  • FOwningThread
  • FLockEvent
  • FSpinCount
  • SetSpinCount
  • ASpinCount
  • Timeout
  • TryEnter
  • Wait
  • ALock
  • Pulse
  • PulseAll
  • IInterface
  • IEnumerable
  • IDispatch
  • FRefCount
  • TInterfacedObject1
  • TInterfacedObject
  • RefCount
  • PShortString
  • UTF8String
  • RawByteString
  • PByte
  • PInt64
  • PExtended
  • PCurrency
  • PVariant
  • PPointer
  • TDateTime
  • TDate
  • TVarArrayBound
  • ElementCount
  • LowBound
  • TVarArrayBoundArray
  • PVarArray
  • TVarArray
  • DimCount
  • Flags
  • ElementSize
  • LockCount
  • Bounds
  • TVarRecord
  • PRecord
  • RecInfo
  • TVarData
  • VType
  • Reserved1
  • Reserved2
  • Reserved3
  • VSmallInt
  • VInteger
  • VSingle
  • VDouble
  • VCurrency
  • VDate
  • VOleStr
  • VDispatch
  • VError
  • VBoolean
  • VShortInt
  • VByte
  • VWord
  • VLongWord
  • VUInt32
  • VInt64
  • VUInt64
  • VString
  • VAny
  • VArray
  • VPointer
  • VUString

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x4b5eec55pushebp
0x4b5eed8becmovebp, esp
0x4b5eef83c4a4addesp, -0x5c
0x4b5ef253pushebx
0x4b5ef356pushesi
0x4b5ef457pushedi
0x4b5ef533c0xoreax, eax
0x4b5ef78945c4movdword ptr [ebp - 0x3c], eax
0x4b5efa8945c0movdword ptr [ebp - 0x40], eax
0x4b5efd8945a4movdword ptr [ebp - 0x5c], eax
0x4b5f008945d0movdword ptr [ebp - 0x30], eax
0x4b5f038945c8movdword ptr [ebp - 0x38], eax
0x4b5f068945ccmovdword ptr [ebp - 0x34], eax
0x4b5f098945d4movdword ptr [ebp - 0x2c], eax
0x4b5f0c8945d8movdword ptr [ebp - 0x28], eax
0x4b5f0f8945ecmovdword ptr [ebp - 0x14], eax
0x4b5f12b8b8144b00moveax, 0x4b14b8
0x4b5f17e8b072f5ffcall0x40d1cc
0x4b5f1c33c0xoreax, eax
0x4b5f1e55pushebp
0x4b5f1f68e2654b00push0x4b65e2
0x4b5f2464ff30pushdword ptr fs:[eax]
0x4b5f27648920movdword ptr fs:[eax], esp
0x4b5f2a33d2xoredx, edx
0x4b5f2c55pushebp
0x4b5f2d689e654b00push0x4b659e
0x4b5f3264ff32pushdword ptr fs:[edx]
0x4b5f35648922movdword ptr fs:[edx], esp
0x4b5f38a134e64b00moveax, dword ptr [0x4be634]
0x4b5f3de8a29dffffcall0x4afce4
0x4b5f42e8f598ffffcall0x4af83c
0x4b5f478d55ecleaedx, [ebp - 0x14]
0x4b5f4a33c0xoreax, eax
0x4b5f4ce84fcdf6ffcall0x422ca0
0x4b5f518b55ecmovedx, dword ptr [ebp - 0x14]
0x4b5f54b8841d4c00moveax, 0x4c1d84
0x4b5f59e8a21ef5ffcall0x407e00
0x4b5f5e6a02push2
0x4b5f606a00push0
0x4b5f626a01push1
0x4b5f648b0d841d4c00movecx, dword ptr [0x4c1d84]
0x4b5f6ab201movdl, 1
0x4b5f6ca1ec384200moveax, dword ptr [0x4238ec]
0x4b5f71e8d2def6ffcall0x423e48
0x4b5f76a3881d4c00movdword ptr [0x4c1d88], eax
0x4b5f7b33d2xoredx, edx
0x4b5f7d55pushebp
0x4b5f7e684a654b00push0x4b654a
0x4b5f8364ff32pushdword ptr fs:[edx]
0x4b5f86648922movdword ptr fs:[edx], esp
0x4b5f89e82a9effffcall0x4afdb8
0x4b5f8ea3901d4c00movdword ptr [0x4c1d90], eax
0x4b5f93a1901d4c00moveax, dword ptr [0x4c1d90]
0x4b5f9883780c01cmpdword ptr [eax + 0xc], 1
0x4b5f9c7548jne0x4b5fe6
0x4b5f9ea1901d4c00moveax, dword ptr [0x4c1d90]
0x4b5fa3ba28000000movedx, 0x28
0x4b5fa8e8c7e7f6ffcall0x424774
0x4b5fad8b15901d4c00movedx, dword ptr [0x4c1d90]
0x4b5fb33b4228cmpeax, dword ptr [edx + 0x28]
callbranchretstackarithregisterimmediatememory

Installer package analysis

33 packaged files
Packagescript-driven installer (setup data 6.1.0 (unicode))
NameBrightSlide 6.1.0
Contents listed33 entries · 1 unpacked to a temporary path
Password protectedno
Languages
english
What stands out
1 executable land in the temporary directory
Packaged contents (33)
PathSizeDigest
app/BrightSlide.ppam 9.95 MiB 7d6f8edb23612234491…
app/BrightSlide Helper.ppam 77.8 KiB 143eb10d6949d6758c2…
app/painter.cur 133 KiB 6513f46f09abac97d71…
userappdata/BrightSlide/MyAnimations.pptx 42.3 KiB ff4394d76adb5563aed…
app/alignToFirstL.png 660 B 3eb16c0bee9067e690f…
app/alignToGuidesL.png 664 B e8573b90dd8df5b60cd…
app/alignToL.png 667 B df1b423c566bd25e434…
app/alignToSelectionL.png 724 B aab239c6ddbb60b2c79…
app/alignToSlideL.png 677 B 8f8fff9323b8386f0b3…
app/customCheckboxOffN.png 151 B e8914498164a18f61d9…
app/customCheckboxOnN.png 325 B de40bcb8c08b0d4f14c…
app/customRadioOffN.png 567 B 71243b40c9e3ce6ff4e…
app/customRadioOnN.png 721 B 117ac1671a62c924f43…
app/hideObjectN-Invert.png 1.43 KiB f0f84d03b5195b4b109…
app/hideObjectN.png 477 B b958efb0c551ee73eac…
app/multiPainterOffL.png 1.72 KiB dc5fe651f342d08c6d4…
app/multiPainterOnL.png 2.26 KiB dd9c7b66c33b7debb1c…
app/paintersL.png 2.23 KiB fcf8e3ca0e7b206f201…
app/paintersOnL.png 2.55 KiB d6b0ea49899804190b0…
app/setReferencePoint1N.png 209 B 18b60f1855f31d91511…
app/setReferencePoint2N.png 211 B fd5daa6cf6666956306…
app/setReferencePoint3N.png 202 B 3957f2be5d8fc119285…
app/setReferencePoint4N.png 203 B 45de31d835c85387d7e…
app/setReferencePoint5N.png 205 B 4184652eb77b50eeef6…
app/setReferencePoint6N.png 197 B f9518489d109e4f83f8…

Showing 25 of 33.

Import fingerprint

4 related samples
Fingerprint96:ukH+NbJj7t9X1tOz9Yhr8XbalVNb75krE:u0KX9FwBCI2rNb9kA
Imports read142 functions from 7 libraries (142 distinct)
Comparableyes
Compared against27 stored samples
Samples built on the same import table (4)

An identical import table survives repacking, so a high score usually means the same code rebuilt. It is corroboration, not a verdict of its own.

ScoreSampleVerdict
91 13e2ef2b923691986ebf894… suspicious
91 13e2ef2b923691986ebf894… suspicious
91 13e2ef2b923691986ebf894… suspicious
88 f88b4200079dca27da65cd2… suspicious

Screen recording

34 frames · screen recording · 108s · ended early

The run was ended early from the console, so the recording covers only the 108s the sample actually ran.

Screen recording frame
1 / 34
0:00 · 1/34
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 107s · ended early

5 process(es) observed; malicious behavior: dropped_executable, timestomping; 1 dropped executable(s)

LaunchedC:\Users\user\Desktop\Setup_BrightSlide_1.1.2.exe
Privilegestandard
Defense Evasion::Timestomp [T1070.006]
dropped_executabletimestomping
Telemetry sources: Kernel ETW (0 events) agent poll: 30In-process monitor: 467

Evasion / anti-analysis checks

7 checks
MED
Check for time delay via GetTickCount Capability rule
MITRE T1622 · Debugger detection
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Debugger Detection::Process Environment Block Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Debugger Detection::Timing/Delay Check GetTickCount Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Dynamic Analysis Evasion::Delayed Execution Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Anti-debug check dynamic
MITRE T1622 · anti_debug
MED
Anti-VM check dynamic
MITRE T1497.001 · anti_vm

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Anti-analysis API trace

5 APIs · 5 processes hooked

Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

APISignalCallsSleepScored
GetSystemFirmwareTable anti_vm 1 - yes
GetTickCount timing 1000 - no corroborates, never convicts on its own - ordinary software calls this
GetTickCount64 timing 100 - no corroborates, never convicts on its own - ordinary software calls this
GetVolumeInformationW anti_vm 1 - no corroborates, never convicts on its own - ordinary software calls this
IsDebuggerPresent anti_debug 10 - yes
Call order 35 events sampled
GetTickCountGetTickCount64IsDebuggerPresentGetTickCount64GetTickCountGetTickCount64GetTickCountIsDebuggerPresentGetTickCountGetVolumeInformationWGetTickCountGetTickCount64GetTickCount64GetTickCount64GetTickCount64GetTickCountGetTickCountGetTickCountGetTickCount64GetTickCountIsDebuggerPresentGetTickCountGetVolumeInformationWIsDebuggerPresentGetTickCountGetTickCount64GetTickCount64GetTickCount64GetTickCountIsDebuggerPresentGetTickCount64GetTickCountGetSystemFirmwareTableGetTickCountIsDebuggerPresent

How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

No module load worth listing. In-process hooks were placed in 5 processes and recorded no explicit module load, so this is an observation rather than a gap. Modules brought in by the sample's own import table are never seen here.

File timestamp writes

34 files

Captured in the calling process, so the values are the ones the sample asked for rather than what the file ended up with. Setting file times is ordinary - installers and archivers do it - so only a write that moves a file's history backwards is marked as timestomping.

C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-NMH9K.tmp pid 5288
created=unchanged modified=2026-10-13T14:19:29Z accessed=unchanged
was created=2026-10-13T14:20:15Z modified=2026-10-13T14:20:15Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-B5Q02.tmp pid 5288
created=unchanged modified=2026-05-26T11:30:22Z accessed=unchanged
was created=2026-10-13T14:20:15Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-JMNOG.tmp pid 5288
created=unchanged modified=2024-10-28T17:58:06Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-0IFRU.tmp pid 5288
created=unchanged modified=2026-03-24T12:49:52Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\BrightSlide\is-CI0RD.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-DDO00.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-7TUR7.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-MN8OF.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-4S8KV.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-T7NMP.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-5OP01.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-KCLFL.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-SIQ41.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-1D894.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-F39UP.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-QF0OB.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-5I2QC.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-EM5FP.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-C5KJ5.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-CQGT7.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-G9QDN.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-0UTNH.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-FIOST.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-45TT1.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-R2GNR.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-L3O14.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-TGHVQ.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-GA7AI.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-J3RMF.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-T0Q19.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-LOK3K.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-87ACH.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\is-RC5BC.tmp pid 5288
created=unchanged modified=2024-02-09T12:37:10Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:17Z
BACKDATED
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\is-F7E0P.tmp pid 5288
created=unchanged modified=2025-01-09T13:13:40Z accessed=unchanged
was created=2026-10-13T14:20:17Z modified=2026-10-13T14:20:18Z

Command lines, unwrapped

5 read

5 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

5processes
21file operations
267registry operations
1dropped file

Setup_BrightSlide_1.1.2.exe

5 processes
5 processes

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

File operations11
1Mechanisms found
90Methods checked
1ATT&CK techniques
MEDHighest severity

Persistence mechanisms

1 found
MethodFamilyATT&CKEvidenceSeverity
Office Add-in ×2 Scripting & Applications T1137.006 Runtime MED

Runtime evidence means the mechanism was established during detonation. A static hint means the sample only references the technique.

Detection coverage

1 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 1 / 9
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 detected
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 15 write 0 modify 7 delete 8 rename 2

Dropped files

1 payload
PathSHA-256SizeProcessTimeDownload
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\BrightSlide Assets.msi c94780860fed113e429b4479… 1.2 MB BrightSlide Assets.exe pid 1356 2026-10-13T14:20:19.772Z -

Dropped payload analysis

not examined

The run recorded 1 payload write and the guest returned no payload capture, so no bytes were kept and none of these files was examined. Their paths are listed above. Read this as a gap in the evidence: nothing here says those payloads were harmless.

File & registry ops

32 file · 267 registry · sample scope

File operation times: 25 timed1 operation time6 not observed

OperationTargetProcess
create
C:\Users\user\AppData\Local\Programs
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:19:32.205
create
C:\Users\user\AppData\Local\Programs\Common
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:19:32.205
create
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\_isetup
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:19:32.205
create
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\BrightSlide Assets.exe
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 not observed
create
C:\Users\user\AppData\Roaming\BrightSlide
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:20:18.560
rename
C:\Users\user\AppData\Roaming\BrightSlide\MyAnimations.pptx
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:20:18.574
renamepayload
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\BrightSlide Assets.exe
3.3 MBsame path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:20:18.996
create
C:\Users\user\AppData\Roaming\BrightCarbon
same path
 BrightSlide Assets.exe pid 1356 2026-10-13 17:20:19.772
create
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1
same path
 BrightSlide Assets.exe pid 1356 2026-10-13 17:20:19.772
create
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install
same path
 BrightSlide Assets.exe pid 1356 2026-10-13 17:20:19.772
create
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\holder0.aiph
same path
 BrightSlide Assets.exe pid 1356 2026-10-13 17:20:19.772
createpayload
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\BrightSlide Assets.msi
1.2 MBsame path
 BrightSlide Assets.exe pid 1356 2026-10-13 17:20:19.772
modify
C:\Users\user\AppData\Roaming\BrightSlide
same path
 - 2026-10-13 17:20:18.574
delete
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\holder0.aiph
same path
 BrightSlide Assets.exe pid 1356 2026-10-13 17:20:26.556
create
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\BrightSlide Assets1.cab
 BrightSlide Assets.exe pid 1356 not observed
modify
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\holder0.aiph
same path
 - 2026-10-13 17:20:19.772
modify
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install
same path
 - 2026-10-13 17:20:19.772
modifypayload
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\BrightSlide Assets.msi
1.2 MBsame path
 - 2026-10-13 17:20:19.772
modify
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1
same path
 - 2026-10-13 17:20:19.772
modify
C:\Users\user\AppData\Roaming\BrightCarbon
same path
 - 2026-10-13 17:20:19.772
delete
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\BrightSlide Assets.msi
same path
 - 2026-10-13 17:20:38.517
delete
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install
same path
 - 2026-10-13 17:20:38.517
delete
C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1
same path
 - 2026-10-13 17:20:38.517
delete
C:\Users\user\AppData\Roaming\BrightCarbon
same path
 - 2026-10-13 17:20:38.517
delete
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\BrightSlide Assets.exe
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:20:51.572
delete
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\BrightSlide Assets.exe
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:20:51.572operation time
create
C:\Users\user\AppData\Local\Temp\{8269BC24-434D-41B3-B068-C6EABF6739F7} - OProcSessId.dat
 POWERPNT.EXE pid 6012 not observed
modify
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\_isetup
same path
 - 2026-10-13 17:20:51.572
delete
C:\Users\user\AppData\Local\Temp\is-T45NC.tmp\_isetup
same path
 Setup_BrightSlide_1.1.2.tmp pid 5288 2026-10-13 17:20:51.572
create
C:\Users\user\AppData\Local\Temp\Diagnostics\POWERPNT
 POWERPNT.EXE pid 6012 not observed
create
C:\Users\user\AppData\Local\Temp\{1F5ED5E3-DFF2-4887-AAE7-F0908B2FC240}
 POWERPNT.EXE pid 6012 not observed
create
C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
 POWERPNT.EXE pid 6012 not observed
create
Software\Microsoft\RestartManager\Session0000
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\WBEM\CIMOM
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
\REGISTRY\MACHINE\Software\WOW6432Node
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000 = <144 bytes, type 7>
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash = <32 bytes, type 3>
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
Software\VB and VBA Program Settings\BrightSlide\Configuration
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
Software\Microsoft\Office\16.0\PowerPoint\AddIns\BrightSlide
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
Software\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Microsoft\SystemCertificates\CA
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Policies\Microsoft\SystemCertificates\CA
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Policies
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Microsoft\SystemCertificates\Disallowed
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Policies\Microsoft\SystemCertificates\Disallowed
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Microsoft\SystemCertificates\Root
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Root
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Microsoft\SystemCertificates\SmartCardRoot
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Microsoft\SystemCertificates\TrustedPeople
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Policies\Microsoft\SystemCertificates\TrustedPeople
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Microsoft\SystemCertificates\trust
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Policies\Microsoft\SystemCertificates\trust
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\trust
certificate store
 BrightSlide Assets.exe pid 1356 not timed
create
Software\Microsoft\SystemCertificates\My
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
 BrightSlide Assets.exe pid 1356 not timed
create
TenantRestrictions\Payload
 BrightSlide Assets.exe pid 1356 not timed
create
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
 BrightSlide Assets.exe pid 1356 not timed
setvalue
SOFTWARE\VB and VBA Program Settings\BrightSlide\Configuration
Install Folder = C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\VB and VBA Program Settings\BrightSlide\Configuration
Version = 1.1.2
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\VB and VBA Program Settings\BrightSlide\Configuration
Build = 2605 261516
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Office\16.0\PowerPoint\AddIns\BrightSlide
AutoLoad = 1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Office\16.0\PowerPoint\AddIns\BrightSlide
Path = C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\BrightSlide.ppam
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\VB and VBA Program Settings\BrightSlide\Configuration
Ignore MAC OUI = XX:YY:ZZ
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\VB and VBA Program Settings\BrightSlide\Configuration
Installer = EXE
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\VB and VBA Program Settings\BrightSlide\Configuration
Update = True
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
Inno Setup: Setup Version = 6.2.2
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
Inno Setup: App Path = C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
InstallLocation = C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
Inno Setup: Icon Group = BrightSlide
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
Inno Setup: User = user
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
Inno Setup: Language = english
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
DisplayName = BrightSlide version 1.1.2
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
DisplayIcon = C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\unins000.exe
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
UninstallString = "C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\unins000.exe"
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
QuietUninstallString = "C:\Users\user\AppData\Roaming\Microsoft\AddIns\BrightCarbon\BrightSlide\unins000.exe" /SILENT
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
DisplayVersion = 1.1.2
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
Publisher = BrightCarbon
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
URLInfoAbout = https://brightcarbon.com/BrightSlide/
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
HelpLink = https://brightcarbon.com/BrightSlide/
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
URLUpdateInfo = https://brightcarbon.com/BrightSlide/
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
NoModify = 1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
NoRepair = 1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
InstallDate = 20261013
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
MajorVersion = 1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
MinorVersion = 1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
VersionMajor = 1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
VersionMinor = 1
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{29BB97A8-45FC-480D-A789-DF0212601E9F}_is1
EstimatedSize = 13594
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
ProxyBypass = 1
certificate store
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
IntranetName = 1
certificate store
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet = 1
certificate store
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
setvalue
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect = 0
certificate store
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
certificate store
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
SOFTWARE\Microsoft\Office\Common
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\powerpoint
 POWERPNT.EXE pid 6012 not timed
deletevalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFiles0000
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
Common\Experiment
 POWERPNT.EXE pid 6012 not timed
deletevalue
SOFTWARE\Microsoft\RestartManager\Session0000
RegFilesHash
 Setup_BrightSlide_1.1.2.tmp pid 5288 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\ExperimentEcs\powerpoint
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\ExperimentEcs\powerpoint\Overrides
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\powerpoint
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSessionUpgradeCandidate\powerpoint
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\powerpoint
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\powerpoint\ConfigContextData
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\Common\CrashPersistence\POWERPNT
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\Common\CrashPersistence\POWERPNT\6012
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\PowerPoint\Resiliency
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\PowerPoint\Resiliency\StartupItems
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\Migration\PowerPoint
 POWERPNT.EXE pid 6012 not timed
create
Software\Microsoft\WBEM\CIMOM
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\Experiment\powerpoint
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\PowerPoint
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\PowerPoint\AddinsData
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\PowerPoint\AddinsData\PDFMaker.OfficeAddin
 POWERPNT.EXE pid 6012 not timed
create
TypeLib\{91493440-5A91-11CF-8700-00AA0060263B}\2.c\0\win32
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\PowerPoint\AddInLoadTimes
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\IOAV
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\IOAV\RegisteredScanners
 POWERPNT.EXE pid 6012 not timed
create
Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109F00000000100000000F01FEC\Usage
 POWERPNT.EXE pid 6012 not timed
create
Software\Microsoft\Office\Common\ExdCache
 POWERPNT.EXE pid 6012 not timed
create
Software\Microsoft\Office\Common\ExdCache\PPT11.0
 POWERPNT.EXE pid 6012 not timed
setvalue
Software\Microsoft\Office\Common\ExdCache\PPT11.0
MSForms = 1
 POWERPNT.EXE pid 6012 not timed
setvalue
Software\Microsoft\Office\Common\ExdCache\PPT11.0
MSComctlLib = 1
 POWERPNT.EXE pid 6012 not timed
setvalue
Software\Microsoft\VBA\Forms3\Controls
EnableActiveXControlArchitetureIndependent = 0
 POWERPNT.EXE pid 6012 not timed
setvalue
Software\Microsoft\VBA\Forms3\Controls
EnableActiveXControlMSWebBrowserArchiteturePersistenceIssue = 0
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\16.0\Common\IOAV\RegisteredScanners\{2781761E-28E0-4109-99FE-B9D127C57AFE}
 POWERPNT.EXE pid 6012 not timed
setvalue
Software\Microsoft\Office\Common\CrashPersistence\POWERPNT\6012
0 = <107 bytes, type 3>
 POWERPNT.EXE pid 6012 not timed
create
\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000\Software\Microsoft\Office\Common\ExdCache\PPT11.0
 POWERPNT.EXE pid 6012 not timed
create
SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
 POWERPNT.EXE pid 6012 not timed
create
Software\Microsoft\IdentityCRL\ClockData
 POWERPNT.EXE pid 6012 not timed
create
TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0\FLAGS
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0\0
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0\0\win32
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0\HELPDIR
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0
(default) = Microsoft Forms 2.0 Object Library
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0\FLAGS
(default) = 6
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0\0\win32
(default) = C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\TypeLib\{994687BA-8260-4FAB-8EAF-7BA2D70BD724}\2.0\HELPDIR
(default) = C:\Users\user\AppData\Local\Temp\VBE
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
(default) = Font
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}
(default) = Font
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
(default) = IDataAutoWrapper
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}
(default) = IDataAutoWrapper
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
(default) = IReturnInteger
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}
(default) = IReturnInteger
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
(default) = IReturnBoolean
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}
(default) = IReturnBoolean
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
(default) = IReturnString
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}
(default) = IReturnString
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
(default) = IReturnSingle
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}
(default) = IReturnSingle
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
(default) = IReturnEffect
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}
(default) = IReturnEffect
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
(default) = IControl
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}
(default) = IControl
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
(default) = Controls
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}
(default) = Controls
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
(default) = IOptionFrame
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}
(default) = IOptionFrame
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
(default) = _UserForm
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}
(default) = _UserForm
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
(default) = ControlEvents
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}
(default) = ControlEvents
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
(default) = FormEvents
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}
(default) = FormEvents
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
(default) = OptionFrameEvents
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}
(default) = OptionFrameEvents
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
(default) = ILabelControl
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}
(default) = ILabelControl
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
(default) = ICommandButton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}
(default) = ICommandButton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcText
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcText
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcList
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcList
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcCombo
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcCombo
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcCheckBox
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcCheckBox
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcOptionButton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcOptionButton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcToggleButton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}
(default) = IMdcToggleButton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
(default) = IScrollbar
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}
(default) = IScrollbar
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
(default) = Tab
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}
(default) = Tab
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
(default) = Tabs
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}
(default) = Tabs
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
(default) = ITabStrip
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}
(default) = ITabStrip
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
(default) = ISpinbutton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}
(default) = ISpinbutton
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\WOW6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
create
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}
 POWERPNT.EXE pid 6012 not timed
setvalue
\Registry\User\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Interface\{4C599243-6926-101B-9992-00000B65C6F9}
(default) = IImage
 POWERPNT.EXE pid 6012 not timed

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

10 answered no 13 had nothing to check
0Sources with a hit
10Sources queriedof 23 available
470.5kFeed records
0Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 2,934 records
39 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
4 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,146 records
39 minutes ago
URLhaus payload hashes File hash clean not in feed 1,658 records
39 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check
SourceChecksResultDetailFeed
blocklist.de IP / domain / URL not checked no IP, domain or URL observed to check 27.6k records
39 minutes ago
CINS Army IP / domain / URL not checked no IP, domain or URL observed to check 15k records
39 minutes ago
Emerging Threats IP / domain / URL not checked no IP, domain or URL observed to check 482 records
39 minutes ago
Feodo Tracker IP / domain / URL not checked no IP, domain or URL observed to check 5 records
39 minutes ago
IPsum IP / domain / URL not checked no IP, domain or URL observed to check 19.7k records
39 minutes ago
Phishing.Database IP / domain / URL not checked no IP, domain or URL observed to check 391.5k records
4 hours ago
ThreatFox IP / domain / URL not checked no IP, domain or URL observed to check 1,146 records
39 minutes ago
URLhaus IP / domain / URL not checked no IP, domain or URL observed to check no records ingested

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
11 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

2 clear
SourceChecksResultDetailFeed
Sigma rules Behavior log clean - 2,275 records
6 hours ago
Signature rules Sample content clean 5 structural rules matched (file properties, not findings) 110 records
39 minutes ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 5 process image paths, none masqueraded 245 records
39 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
38 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
39 minutes ago
LOLRMM Names and domains clean 6 name/domain indicators checked, no remote-management tooling 360 records
38 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 3 suspicious 3 info

File indicators

5
SeverityTypeIndicatorDescription
info sample_sha256 10b9c4411a341329bb4b453b2a3fe7c635bb6caf086cadd716d6c56bba87c1d3 Submitted sample (SHA256)
info sample_md5 5219b58cd85204f19e40701ec53730c9 Submitted sample (MD5)
info imphash e569e6f445d32ba23766ad67d1e3787f Import table hash (imphash)
suspicious dropped_file C:\Users\user\AppData\Roaming\BrightCarbon\BrightSlide Assets 1.0.1\install\BrightSlide Assets.msi Executable written to disk during execution
suspicious dropped_sha256 c94780860fed113e429b4479b03979c86dc35d91f40b6396fa3823be0664a24c SHA256 of a file written during execution

Registry indicators

1
SeverityTypeIndicatorDescription
suspicious registry_key \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Autostart / persistence key

MITRE ATT&CK

1 technique
Defense Evasion
Timestomp
T1070.006

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2740

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

3 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

SubmittedEnvironmentVerdictScore
2026-10-13 17:44 Windows 10 22H2 No threats detected 0/100
2026-10-13 17:39 Windows 10 22H2 No threats detected 0/100
2026-10-13 17:18 Shown below Windows 10 22H2 Nothing conclusive 12/100