c4d2c9d1c36f9018c72d3703c2d1c775df4700d9a2d8b49130a278a5629dd104

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	integrator.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 4 IoCs

pid	Process
2328	setup.exe
4684	dismhost.exe
1288	ose.exe
4776	ose00000.exe

Loads dropped DLL 18 IoCs

pid	Process
2864	uninstall_office.exe
2864	uninstall_office.exe
2864	uninstall_office.exe
4684	dismhost.exe
4684	dismhost.exe
4684	dismhost.exe
4684	dismhost.exe
4684	dismhost.exe
3876	MsiExec.exe
1536	MsiExec.exe
3876	MsiExec.exe
1536	MsiExec.exe
3876	MsiExec.exe
3876	MsiExec.exe
1536	MsiExec.exe
1536	MsiExec.exe
1536	MsiExec.exe
764	MsiExec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5C615ED6-4F9F-48BE-8D84-17409196DE36}\InProcServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82B02373-B5BC-11CF-810F-00A0C9030074}\InprocServer32\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A249E9F6-5B28-4ED1-8AF0-C9B9C5195486}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A683C92-BA84-11CF-8110-00A0C9030074}\InprocServer32\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000209F1-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDFE337F-4987-4EC8-BDE3-133FA63D5D85}\InProcServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3FD37ABB-F90A-4DE5-AA38-179629E64C2F}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33154C99-BF49-443D-A73C-303A23ABBE97}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E169-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E17C-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91493448-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4693FF15-B962-420A-9E5D-176F7D4B8321}\InProcServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{355822FC-86F1-4BE8-B5F0-A33736789641}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E132-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9800F18F-3D86-4744-A7D0-540989C86D7B}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E119-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE39F3D7-1B13-11D0-887F-00A0C90F2744}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A683C93-BA84-11CF-8110-00A0C9030074}\InprocServer32\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82B02373-B5BC-11CF-810F-00A0C9030074}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82B02375-B5BC-11CF-810F-00A0C9030074}\InprocServer32\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7FAC39E-7FF1-49AA-98CF-A1DDD316337E}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{42089D2D-912D-4018-9087-2B87803E93FB}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5383EF74-273B-4278-AB0C-CDAA9FD5369E}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E185-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE39F3D8-1B13-11D0-887F-00A0C90F2744}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{367E582C-F71C-4BF9-AA1B-9F62B793E9C5}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\LocalServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020812-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020820-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82B02375-B5BC-11CF-810F-00A0C9030074}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8A683C93-BA84-11CF-8110-00A0C9030074}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F09D237B-3FD1-4900-BEF2-3471CA68142D}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62B4D041-4667-40B6-BB50-4BC0A5043A73}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6EE84065-8BA3-4a8a-9542-6EC8B56A3378}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8D4F994C-EBBE-4F8D-BA4B-AE20CD36E72D}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020812-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82B02374-B5BC-11CF-810F-00A0C9030074}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{506F4668-F13E-4AA1-BB04-B43203AB3CC0}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5A1DCFD3-7982-48F2-8A3D-5C35272862DE}\InProcServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{274C2936-A842-45f3-A457-FB4BA4ED1BA2}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{91493443-5A91-11CF-8700-00AA0060263B}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E170-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA936B63-AC8B-11D1-B6E5-00A0C90F2744}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5CEF5610-713D-11CE-80C9-00AA00611080}\InprocServer32\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{490D6966-005D-36A5-B7EF-521A24207E7E}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CD7791B9-43FD-42C5-AE42-8DD2811F0419}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000209F0-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99D651D7-5F7C-470E-8A3B-774D5D9536AC}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3956DCF-D1C7-4375-AAAA-22FF8191C479}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E178-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE39F3D8-1B13-11D0-887F-00A0C90F2744}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{805B7F91-C9CF-4EDF-ACA6-775664FDFB3E}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000CDB0D-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE39F3D7-1B13-11D0-887F-00A0C90F2744}\InprocServer32\15.0.0.0	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log	addinutil.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\0949DB10-F8DF-4989-8898-3B823BE313C0\TxFO\root\vfs\programfilescommonx64\microsoft shared\office16\msoxev.dll	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\0949DB10-F8DF-4989-8898-3B823BE313C0\TxFO\root\vfs\programfilescommonx86\microsoft shared\office16\msoxmlmf.dll	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\Office16\OSPP.HTM	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\0949DB10-F8DF-4989-8898-3B823BE313C0\TxFO\root\vfs\programfilescommonx64\microsoft shared\office16\msvcp140.dll	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\0949DB10-F8DF-4989-8898-3B823BE313C0\TxFO\root\vfs\programfilescommonx64\microsoft shared\office16\msoshext.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\vcruntime140.dll	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\extensibility.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\Office16\SLERROR.XML	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\Office16\OSPP.VBS	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\0949DB10-F8DF-4989-8898-3B823BE313C0\TxFO\root\office16\visshe.dll	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\stdole.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\0949DB10-F8DF-4989-8898-3B823BE313C0\TxFO\root\vfs\programfilescommonx64\microsoft shared\office16\vcruntime140.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Microsoft Office\root\VFS\Common AppData\Microsoft Help\nslist.hxl	integrator.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\0949DB10-F8DF-4989-8898-3B823BE313C0\TxFO\root\vfs\programfilescommonx86\microsoft shared\office16\vcruntime140.dll	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.stdformat.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll	OfficeClickToRun.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\msvcp140.dll	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe	OfficeClickToRun.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\pubpol32.dat	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\MODMBNZZBO\Policy.11.0.Microsoft.Office.Interop.SmartTag.config	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\temp\L2DLI8SSEJ\Microsoft.Vbe.Interop.Forms.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\concrt140.dll_x86	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\PublisherPolicy.tme	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol36.dat	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSIB44B.tmp	msiexec.exe
File created	C:\Windows\assembly\pubpol34.dat	msiexec.exe
File created	C:\Windows\assembly\pubpol43.dat	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\temp\NAD18F79B6\Microsoft.Office.Tools.v4.0.Framework.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\assembly\temp\GL2MGS0B47\Policy.12.0.Office.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\QX8U5QVJHU\msdatasrc.dll	msiexec.exe
File created	C:\Windows\assembly\pubpol33.dat	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI4A16.tmp	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\HICE4U0J9M\Microsoft.Office.Tools.Outlook.v9.0.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\QOOOEVCNPT\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\G6FEKEAP6Q\Microsoft.Office.Tools.Common.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\057XO0D3QX\Microsoft.Office.Tools.Excel.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	setup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	setup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	integrator.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor\ULSTagIds0 = "18679566,5804129,7202269,23978014,39965824,7692557,5850525,34198423,41484365,17962391,17962392"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\ClickToRun\C2RClient\C2RClientReturnCode\4352_Status = "started"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\ClickToRun\C2RClient\C2RClientReturnCode\4352_ExitCode = "0"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\DevModes2	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|1688622158"	integrator.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020821-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AAE363E2-3D91-4B0C-9021-EFDA0ACBD858}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B1AC486B-FEB5-4F91-AB5A-674BD3C93FF7}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB13B3C3-AF9B-43DB-9DF8-B2F65AA5E21B}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D6362D32-B464-4A8B-BEFC-0E4F0C1709A0}\12.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{336C75F2-4E4C-47c7-B4A9-D99AA7F81591}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AF2102B9-8C24-358E-B851-05D1803A4356}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E101-0000-0000-C000-000000000046}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{769ADDEF-E3D4-3EEF-B2B4-8F5B21BD06C6}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8D186C8F-7206-3309-AC33-E019D5178DC8}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D21F63DD-C9A1-3719-B135-D36ED80E418F}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\VersionIndependentProgID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{025031AF-7631-3CDE-AE61-02F5421C6466}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A94116C6-61BA-3FD4-9DD5-296B3CF91876}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{317A54C0-C7B1-11CE-9AFD-00AA00600AB8}\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5504BE45-A83B-4808-900A-3A5C36E7F77A}\Version	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{03868CF8-17AE-3586-AA9C-B534AAB88582}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A63EAD2A-8765-382D-B323-0101B69D5F97}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6DA9AEC5-2BB1-3E4B-80AD-ED6970339858}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{ADEADB7E-F268-4574-90FE-BC0BF4B28B3C}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{79C569A5-0A9F-3922-BC4D-908835FFED05}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{97F81678-ACCD-3F4C-A9F2-52653F4431DE}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{507171A9-0D7B-47CA-8DF5-56B23ACDC623}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F83E-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{B2EDC2A3-924D-3C82-B34C-DE7E8F03BD0E}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D6166973-3665-4EDB-94B0-77C65C34B51C}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6D1EDF65-FB90-465C-8777-015D7028E975}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7D94A0AD-E266-362E-B1A3-2A69D3DBD7D2}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E169-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE39F3D6-1B13-11D0-887F-00A0C90F2744}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1EB89D6-0A9C-4575-A0AE-654A990A454C}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A8FB07E5-9C29-4F16-9DC4-CA6333719385}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{025031AF-7631-3CDE-AE61-02F5421C6466}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{19B25EA5-F83D-3EC9-9303-96E50B3E7BDC}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B0BD075-929C-4E52-AAD1-458C81A10B24}\ProgID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E119-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E893BD55-3FC7-3CDA-9281-1ACB65441C8B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\LocalServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{890A6F63-C632-3B38-993A-72B1997B1F0A}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000209F1-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C500DDD8-DC7F-30B8-8816-5D28D9F1DED1}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADEF5-C265-11D0-BCED-00A0C90AB50F}\Programmable	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E17C-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6911A8C8-1743-4AAF-988B-55FF9AE94329}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\bootstrap.vsto.1\DocObject	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{507171A9-0D7B-47CA-8DF5-56B23ACDC623}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-excel.12	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{317A54C0-C7B1-11CE-9AFD-00AA00600AB8}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{66B3A5BE-C68B-42E2-8EF9-A5BD49AF516B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1C72E0F9-FA29-3C15-ABEA-794E2D17834F}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{16E571E0-040B-11CF-8283-00AA004BA6AE}\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\EnableFullPage\.vssm	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3FD37ABB-F90A-4DE5-AA38-179629E64C2F}\Version	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{018AA0E3-9D23-3088-B140-D44701BF2A6A}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9D522B14-60B4-39E4-B4A7-AD4ECCE5512C}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FDE774C0-9AA8-11CD-84DB-00006B82871A}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{74BD8162-6E56-3BCB-9E42-C9DD75022A6A}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EBC7FDE3-6899-11CE-80C0-00AA00611080}\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\Programmable	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{CB5DD948-AAB3-405F-9F29-79468F1F5971}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E119-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{05E7A42A-303C-371A-B137-3635FDDD54AA}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00024500-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe
2828	powershell.exe
2828	powershell.exe
924	powershell.exe
924	powershell.exe
1928	powershell.exe
1928	powershell.exe
4352	OfficeClickToRun.exe
4352	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeBackupPrivilege	2828	powershell.exe
Token: SeRestorePrivilege	2828	powershell.exe
Token: SeDebugPrivilege	924	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeShutdownPrivilege	4580	integrator.exe
Token: SeIncreaseQuotaPrivilege	4580	integrator.exe
Token: SeSecurityPrivilege	4024	msiexec.exe
Token: SeCreateTokenPrivilege	4580	integrator.exe
Token: SeAssignPrimaryTokenPrivilege	4580	integrator.exe
Token: SeLockMemoryPrivilege	4580	integrator.exe
Token: SeIncreaseQuotaPrivilege	4580	integrator.exe
Token: SeMachineAccountPrivilege	4580	integrator.exe
Token: SeTcbPrivilege	4580	integrator.exe
Token: SeSecurityPrivilege	4580	integrator.exe
Token: SeTakeOwnershipPrivilege	4580	integrator.exe
Token: SeLoadDriverPrivilege	4580	integrator.exe
Token: SeSystemProfilePrivilege	4580	integrator.exe
Token: SeSystemtimePrivilege	4580	integrator.exe
Token: SeProfSingleProcessPrivilege	4580	integrator.exe
Token: SeIncBasePriorityPrivilege	4580	integrator.exe
Token: SeCreatePagefilePrivilege	4580	integrator.exe
Token: SeCreatePermanentPrivilege	4580	integrator.exe
Token: SeBackupPrivilege	4580	integrator.exe
Token: SeRestorePrivilege	4580	integrator.exe
Token: SeShutdownPrivilege	4580	integrator.exe
Token: SeDebugPrivilege	4580	integrator.exe
Token: SeAuditPrivilege	4580	integrator.exe
Token: SeSystemEnvironmentPrivilege	4580	integrator.exe
Token: SeChangeNotifyPrivilege	4580	integrator.exe
Token: SeRemoteShutdownPrivilege	4580	integrator.exe
Token: SeUndockPrivilege	4580	integrator.exe
Token: SeSyncAgentPrivilege	4580	integrator.exe
Token: SeEnableDelegationPrivilege	4580	integrator.exe
Token: SeManageVolumePrivilege	4580	integrator.exe
Token: SeImpersonatePrivilege	4580	integrator.exe
Token: SeCreateGlobalPrivilege	4580	integrator.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe
Token: SeRestorePrivilege	4024	msiexec.exe
Token: SeTakeOwnershipPrivilege	4024	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2328	setup.exe
3052	OfficeClickToRun.exe
4580	integrator.exe
4352	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2864	1272	uninstall_office.exe	79
PID 1272 wrote to memory of 2864	1272	uninstall_office.exe	79
PID 2864 wrote to memory of 2328	2864	uninstall_office.exe	80
PID 2864 wrote to memory of 2328	2864	uninstall_office.exe	80
PID 2864 wrote to memory of 2328	2864	uninstall_office.exe	80
PID 2328 wrote to memory of 4836	2328	setup.exe	81
PID 2328 wrote to memory of 4836	2328	setup.exe	81
PID 2328 wrote to memory of 4836	2328	setup.exe	81
PID 2328 wrote to memory of 3052	2328	setup.exe	83
PID 2328 wrote to memory of 3052	2328	setup.exe	83
PID 3052 wrote to memory of 2828	3052	OfficeClickToRun.exe	85
PID 3052 wrote to memory of 2828	3052	OfficeClickToRun.exe	85
PID 2828 wrote to memory of 4684	2828	powershell.exe	87
PID 2828 wrote to memory of 4684	2828	powershell.exe	87
PID 3052 wrote to memory of 924	3052	OfficeClickToRun.exe	88
PID 3052 wrote to memory of 924	3052	OfficeClickToRun.exe	88
PID 3052 wrote to memory of 1928	3052	OfficeClickToRun.exe	91
PID 3052 wrote to memory of 1928	3052	OfficeClickToRun.exe	91
PID 4580 wrote to memory of 1040	4580	integrator.exe	97
PID 4580 wrote to memory of 1040	4580	integrator.exe	97
PID 4580 wrote to memory of 668	4580	integrator.exe	99
PID 4580 wrote to memory of 668	4580	integrator.exe	99
PID 4580 wrote to memory of 1540	4580	integrator.exe	101
PID 4580 wrote to memory of 1540	4580	integrator.exe	101
PID 4580 wrote to memory of 2332	4580	integrator.exe	103
PID 4580 wrote to memory of 2332	4580	integrator.exe	103
PID 4024 wrote to memory of 3876	4024	msiexec.exe	108
PID 4024 wrote to memory of 3876	4024	msiexec.exe	108
PID 4024 wrote to memory of 3876	4024	msiexec.exe	108
PID 4024 wrote to memory of 1536	4024	msiexec.exe	109
PID 4024 wrote to memory of 1536	4024	msiexec.exe	109
PID 1536 wrote to memory of 1288	1536	MsiExec.exe	110
PID 1536 wrote to memory of 1288	1536	MsiExec.exe	110
PID 1288 wrote to memory of 4776	1288	ose.exe	111
PID 1288 wrote to memory of 4776	1288	ose.exe	111
PID 3876 wrote to memory of 4432	3876	MsiExec.exe	112
PID 3876 wrote to memory of 4432	3876	MsiExec.exe	112
PID 3876 wrote to memory of 4432	3876	MsiExec.exe	112
PID 3876 wrote to memory of 4236	3876	MsiExec.exe	114
PID 3876 wrote to memory of 4236	3876	MsiExec.exe	114
PID 3876 wrote to memory of 5084	3876	MsiExec.exe	116
PID 3876 wrote to memory of 5084	3876	MsiExec.exe	116
PID 3876 wrote to memory of 5084	3876	MsiExec.exe	116
PID 3876 wrote to memory of 4060	3876	MsiExec.exe	119
PID 3876 wrote to memory of 4060	3876	MsiExec.exe	119
PID 3876 wrote to memory of 4744	3876	MsiExec.exe	120
PID 3876 wrote to memory of 4744	3876	MsiExec.exe	120
PID 3876 wrote to memory of 4744	3876	MsiExec.exe	120
PID 3876 wrote to memory of 4112	3876	MsiExec.exe	122
PID 3876 wrote to memory of 4112	3876	MsiExec.exe	122
PID 3876 wrote to memory of 4196	3876	MsiExec.exe	124
PID 3876 wrote to memory of 4196	3876	MsiExec.exe	124
PID 3876 wrote to memory of 4196	3876	MsiExec.exe	124
PID 3876 wrote to memory of 1268	3876	MsiExec.exe	126
PID 3876 wrote to memory of 1268	3876	MsiExec.exe	126
PID 3876 wrote to memory of 3548	3876	MsiExec.exe	128
PID 3876 wrote to memory of 3548	3876	MsiExec.exe	128
PID 3876 wrote to memory of 3548	3876	MsiExec.exe	128
PID 3876 wrote to memory of 2036	3876	MsiExec.exe	130
PID 3876 wrote to memory of 2036	3876	MsiExec.exe	130
PID 3876 wrote to memory of 1884	3876	MsiExec.exe	132
PID 3876 wrote to memory of 1884	3876	MsiExec.exe	132
PID 3876 wrote to memory of 1884	3876	MsiExec.exe	132
PID 3876 wrote to memory of 908	3876	MsiExec.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\uninstall_office.exe
"C:\Users\Admin\AppData\Local\Temp\uninstall_office.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\uninstall_office.exe
  "C:\Users\Admin\AppData\Local\Temp\uninstall_office.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\_MEI12722\setup.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI12722\setup.exe /configure C:\Users\Admin\AppData\Local\Temp\_MEI12722\uninstall_office.xml
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks system information in the registry
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4836
  - - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      OfficeClickToRun.exe productstoremove=AllProducts updatesenabled.16=False autoactivate=0 forceappshutdown=True sharedcomputerlicensing.16=0 piniconstotaskbar=False acceptalleulas.16=True displaylevel=False bitnessmigration=False flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$App = Get-AppxProvisionedPackage -ONLINE | Where {$_.DisplayName -eq \"Microsoft.Office.Desktop\"}; Remove-ProvisionedAppxPackage -online -allUsers -PackageName $App.PackageName; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.DeprovisionResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.DeprovisionResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.DeprovisionError.scratch' -InputObject $error -Encoding ascii;} "
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\648E6423-A3EB-47E1-A167-5B6EC17A504C\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\648E6423-A3EB-47E1-A167-5B6EC17A504C\dismhost.exe {DC1BBEAF-34B9-49E1-BDFC-F9EFC9EE3F3F}
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "Get-AppXPackage Microsoft.Office.Desktop -allUsers | Remove-AppXPackage -allUsers"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "Get-AppXPackage Microsoft.Office.Desktop -PackageTypeFilter bundle -allUsers | Remove-AppXPackage -allUsers"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1928

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"
1⤵
PID:3256

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
integrator.exe /U /Extension /Msi /License PRIDName=ProPlusRetail.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"
1⤵
- Sets file execution options in registry
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"
  2⤵
  PID:1040
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"
  2⤵
  PID:668
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"
  2⤵
  PID:1540
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"
  2⤵
  PID:2332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding C857F6F95958E4582787DF60927251B1 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3876
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4432
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4236
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5084
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4060
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"
    3⤵
    PID:4744
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"
    3⤵
    PID:4112
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4196
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1268
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"
    3⤵
    PID:3548
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:2036
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1884
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:908
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:2272
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"
    3⤵
    PID:2720
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2544
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2176
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"
    3⤵
    PID:5096
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:1528
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1788
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3164
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"
    3⤵
    PID:3608
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:448
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1668
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:2092
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"
    3⤵
    PID:1488
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"
    3⤵
    PID:4860
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1168
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1268
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:2376
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3776
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1924
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:848
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1952
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4488
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1560
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4888
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5112
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1440
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1512
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3204
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3764
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4380
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4632
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2440
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2912
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4252
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:572
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:820
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4896
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4552
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4608
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1368
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3368
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4264
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2720
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3936
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2648
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4012
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"
    3⤵
    PID:5096
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"
    3⤵
    PID:1528
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3312
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4052
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:4100
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"
    3⤵
    PID:2244
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1668
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4744
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"
    3⤵
    PID:4112
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:116
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2148
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4924
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"
    3⤵
    PID:2572
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:2448
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4948
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4540
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4408
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:1708
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:3024
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"
    3⤵
    PID:1164
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1228
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4216
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"
    3⤵
    PID:2096
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:2564
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"
    3⤵
    PID:3892
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"
    3⤵
    PID:1412
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"
    3⤵
    PID:5044
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"
    3⤵
    PID:4428
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"
    3⤵
    PID:2620
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"
    3⤵
    PID:4568
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1352
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:2524
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:3292
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"
    3⤵
    PID:4552
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4392
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2448
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4132
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:712
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3556
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1572
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3024
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4888
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5112
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4216
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:2096
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:2564
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3892
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2548
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3404
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4428
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4212
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4568
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:572
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:2588
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:956
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4276
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:3552
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4540
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:2136
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2544
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4644
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1084
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4012
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:3580
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4856
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4756
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:1220
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2772
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    PID:2992
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:4544
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 958FC265A2D5173613963D1CE7DDC00C E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe
    "C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe" -standalone:temp
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\Temp\ose00000.exe
      "C:\Windows\Temp\ose00000.exe" -standalone
      4⤵
      Executes dropped EXE
      PID:4776
- - \??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    - Drops file in System32 directory
    PID:756
- - \??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:3868
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding BD994C23BB8E047C96FE4B3A1B891387 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:764

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /standalonesystem
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4352
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates"
  2⤵
  PID:1668
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates 2.0"
  2⤵
  PID:2508
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Subscription Maintenance"
  2⤵
  PID:436
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office ClickToRun Service Monitor"
  2⤵
  PID:1716
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Microsoft Office Touchless Attach Notification"
  2⤵
  PID:3408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery