TCMD.MSI

May 20, 2008
9,195
60
Syracuse, NY, USA
This is getting ridiculous! [Can FFIND show paths relative to its search root?]

Code:
c:\users\vefatica\appdata\roaming\jp software> ffind /s tcmd.msi | cut -c47-
Take Command 13.04 13.04.53\install\B321F08\tcmd.msi
Take Command 13.04 13.04.54\install\6CDFEDC\tcmd.msi
Take Command 13.04 13.04.55\install\4849765\tcmd.msi
Take Command 13.04 13.04.56\install\A0D33EA\tcmd.msi
Take Command 13.04 13.04.57\install\0036A24\tcmd.msi
Take Command 13.04 13.04.58\install\CAB9432\tcmd.msi
Take Command 13.04 13.04.59\install\085C848\tcmd.msi
Take Command 13.04 13.04.60\install\A3AB90E\tcmd.msi
Take Command 13.04 13.04.61\install\D20B69A\tcmd.msi
Take Command 13.04 13.04.62\install\A12BD11\tcmd.msi
Take Command 13.04 13.04.63\install\779AB05\tcmd.msi
Take Command 14.0 14.00.14\install\2308B41\tcmd.msi
Take Command 14.0 14.00.15\install\B3A33F1\tcmd.msi
Take Command 14.0 14.00.16\install\9135A33\tcmd.msi
 
May 20, 2008
9,195
60
Syracuse, NY, USA
More info. Of all those dirs with 7-digit hex names only the ones for the most recent one for v13 and the most recent one for v14 appear in the registry. That's good.

But the latest one for v13 and **all** of them for v14 have files here (?).
Code:
779AB05
C:\windows\installer\{71338FDE-00CA-45D0-8399-4B74C779AB05}
2308B41
C:\windows\installer\{146CB12F-D64D-4F15-81D7-4DC8E2308B41}
B3A33F1
C:\windows\installer\{62AA275D-F931-4B44-8A08-DC3D3B3A33F1}
9135A33
C:\windows\installer\{92C287AB-1304-4659-A719-7D6EF9135A33}
 
May 20, 2008
9,195
60
Syracuse, NY, USA
More info: These, the only TMP files in \windows\installer, are signed by Caphyon.

Code:
C:\Windows\Installer\MSI3F31.tmp
C:\Windows\Installer\MSI39B5.tmp