TCMD.MSI

[vefatica]

This is getting ridiculous! [Can FFIND show paths relative to its search root?]

c:\users\vefatica\appdata\roaming\jp software> ffind /s tcmd.msi | cut -c47-
Take Command 13.04 13.04.53\install\B321F08\tcmd.msi
Take Command 13.04 13.04.54\install\6CDFEDC\tcmd.msi
Take Command 13.04 13.04.55\install\4849765\tcmd.msi
Take Command 13.04 13.04.56\install\A0D33EA\tcmd.msi
Take Command 13.04 13.04.57\install\0036A24\tcmd.msi
Take Command 13.04 13.04.58\install\CAB9432\tcmd.msi
Take Command 13.04 13.04.59\install\085C848\tcmd.msi
Take Command 13.04 13.04.60\install\A3AB90E\tcmd.msi
Take Command 13.04 13.04.61\install\D20B69A\tcmd.msi
Take Command 13.04 13.04.62\install\A12BD11\tcmd.msi
Take Command 13.04 13.04.63\install\779AB05\tcmd.msi
Take Command 14.0 14.00.14\install\2308B41\tcmd.msi
Take Command 14.0 14.00.15\install\B3A33F1\tcmd.msi
Take Command 14.0 14.00.16\install\9135A33\tcmd.msi

 

[vefatica]

More info. Of all those dirs with 7-digit hex names only the ones for the most recent one for v13 and the most recent one for v14 appear in the registry. That's good.

But the latest one for v13 and **all** of them for v14 have files here (?).

779AB05
C:\windows\installer\{71338FDE-00CA-45D0-8399-4B74C779AB05}
2308B41
C:\windows\installer\{146CB12F-D64D-4F15-81D7-4DC8E2308B41}
B3A33F1
C:\windows\installer\{62AA275D-F931-4B44-8A08-DC3D3B3A33F1}
9135A33
C:\windows\installer\{92C287AB-1304-4659-A719-7D6EF9135A33}

 

[vefatica]

More info: These, the only TMP files in \windows\installer, are signed by Caphyon.

C:\Windows\Installer\MSI3F31.tmp
C:\Windows\Installer\MSI39B5.tmp