8dd3f68af9ccbcf347e5b319909fd972e6c29d3c9859b2ba966159ba0ec51d87

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	Visual C++ AIO.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation	cmd.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 46 IoCs

pid	Process
5092	vcredist_x86.exe
2364	vcredist_x64.exe
4956	vcredist_x86.exe
3676	vcredist_x64.exe
4512	VC_redist.x86.exe
1984	VC_redist.x64.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
3680	MsiExec.exe
4760	MsiExec.exe
3396	MsiExec.exe
1148	MsiExec.exe
3124	MsiExec.exe
2116	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
2480	MsiExec.exe
4628	MsiExec.exe
3264	MsiExec.exe
3444	MsiExec.exe
4336	MsiExec.exe
4908	MsiExec.exe
4908	MsiExec.exe
4336	MsiExec.exe
4336	MsiExec.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20250220142311.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vcomp110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm120u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msstdfmt.dll	msiexec.exe
File created	C:\Windows\SysWOW64\picclp32.ocx	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110u.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msmapi32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp110.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71esp.dll	msiexec.exe
File created	C:\Windows\SysWOW64\richtx32.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mscomct2.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\tabctl32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70chs.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110kor.dll	msiexec.exe
File created	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp70.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp110.dll	msiexec.exe
File created	C:\Windows\system32\mfcm120.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\dblist32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc120chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcamp140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mscdrun.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mswcrun.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\PipelineSegments.store	addinutil.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mshtmpgr.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	addinutil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{8122DAB1-ED4D-3676-BB0A-CA368196543E}	msiexec.exe
File created	C:\Windows\assembly\tmp\OHBIX60N\Microsoft.Office.Tools.Excel.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\4QXW24DO\Microsoft.Office.Tools.Outlook.Implementation.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142402631.1\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142405538.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_c2c04980.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142405553.2\mfc90enu.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Installer\SourceHash{C5E3A69D-D391-45A6-A8FB-00B01E2B010D}	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI3EB3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI63A3.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250220142341147.0	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI16F0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4238.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D401961D-3A20-3AC7-943B-6139D5BD490A}	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142346631.1\mfcm90.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\Y9GI4HBFY8\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142346616.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_f4ca2f60.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250220142346647.3	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142405553.1\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.7523_x-ww_3306cf11.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250220142405569.1	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI5FA7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B73.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142341303.0\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250220142346616.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250220142405553.0	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\8ZDHTON84Q\Microsoft.VisualStudio.Tools.Applications.Hosting.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Installer\e580d8b.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20250220142402600.1	msiexec.exe
File created	C:\Windows\assembly\tmp\8GNXNEPQ\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\U3EOE2VD\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI499F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EC7.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142341163.0\msvcm80.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142341225.0\mfc80ENU.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142346663.1\9.0.30729.7523.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20250220142402569.0\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_6ad2c555.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\e580dc4.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4800	4956	WerFault.exe	253
1260	4512	WerFault.exe	264

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000074e11e240694ce490000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000074e11e240000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090074e11e24000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d74e11e24000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000074e11e2400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6DB041E-66D0-48BC-8797-57C24F5C801C}\AlternateCLSID = "{62B025F5-F551-44A9-8BA8-0118EFB9127C}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{97992019-74A6-46C7-9CA3-7F8C0D39940B}\AlternateCLSID = "{29D5EC7E-6245-4DC9-9E53-A9A945AD4ABB}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CA0-15DA-101B-B9A8-444553540000}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAB97084-FC6C-11D0-805D-00C04FB6C701}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4}\AlternateCLSID = "{CFA7636D-CAA1-4F18-868F-8720624C8B86}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{601EB760-8909-11D0-9483-00A0C91110ED}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{67397AA3-7FB1-11D0-B148-00A0C922E820}\AlternateCLSID = "{234086BB-0242-46C5-B71F-5A9B961DB911}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\AlternateCLSID = "{D88A442E-9C85-48E3-A6F8-EF61C93989A0}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6DB041E-66D0-48BC-8797-57C24F5C801C}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CDE57A43-8B86-11D0-B3C6-00A0C90AEA82}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}\AlternateCLSID = "{3D8152C1-0CFD-4968-9684-794046886E31}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\AlternateCLSID = "{53749718-F78D-4A67-8703-8AE050075170}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}\AlternateCLSID = "{703EAF2B-FD9F-41BC-BB81-6C6757A46E5E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10}\AlternateCLSID = "{E404CD92-E7B8-4037-918D-5A18CFD09ED3}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BFCA30D5-DDE3-11D1-B6D9-0000F87557F8}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F219-CCB0-11D0-A316-00AA00688B10}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}\AlternateCLSID = "{4D588145-A84B-4100-85D7-FD2EA1D19831}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\AlternateCLSID = "{942085FD-8AEE-465F-ADD7-5E7AA28F8C14}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\AlternateCLSID = "{F91CAF91-225B-43a7-BB9E-472F991FC402}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CA0-15DA-101B-B9A8-444553540000}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00028C00-0000-0000-0000-000000000046}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{53749718-F78D-4A67-8703-8AE050075170}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\CLSID = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}\AlternateCLSID = "{D3CCB2F7-0D00-4F26-9569-D7C368DE34E2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FAEEE760-117E-101B-8933-08002B2F4F5A}\AlternateCLSID = "{30854451-8F2D-4282-8070-73A801B560A3}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{79C784C5-8F0D-4A55-ADB3-590CCFC8EB0D}\AlternateCLSID = "{80B51087-CE4C-4FAE-8401-B6B3809DD234}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20DD1B9E-87C4-11D1-8BE3-0000F8754DA1}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FE38753A-44A3-11D1-B5B7-0000C09000C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{21D93913-CB0F-11D0-84AC-00A0C90DC8A9}\AlternateCLSID = "{018BCA43-2122-4211-9589-458B6A6E2A63}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CA0-15DA-101B-B9A8-444553540000}\AlternateCLSID = "{47DEF242-7DAF-4828-936A-895FC81D92F8}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1906F94F-8256-480A-8CDF-60821592CB4B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}\AlternateCLSID = "{D7FFEFBC-C693-4E6F-AE2E-ED001389CB17}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{59245250-7A2F-11D0-9482-00A0C91110ED}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\46	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\44	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\43	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\43	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\45	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\45	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F65348F7-505D-4FAB-B66C-D76CFFC2BD78}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\ = "StdDataValue Object"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDE57A52-8B86-11D0-B3C6-00A0C90AEA82}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BDD1F053-858B-11D1-B16A-00C0F0283628}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2B577565-36F7-4351-B2E7-DAFC75E9D72A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{894BA3A3-3CA3-402F-B4FE-CD08337E9535}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{CA67548A-5EBE-413A-B50C-4B9CEB6D66C6}	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83600-895E-11D0-B0A6-000000000000}\ = "IListView"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSComctlLib.ListViewCtrl\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ = "IPanel11"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1F6F8D20-1B7D-11CF-9D53-00AA003C9CB6}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F09D237B-3FD1-4900-BEF2-3471CA68142D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{21D93913-CB0F-11D0-84AC-00A0C90DC8A9}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\MiscStatus	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD2DBE12-F9F8-4E32-B087-DAD1DCEF0783}\MiscStatus\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{38911D8E-E448-11D0-84A3-00DD01104159}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1B6413C2-C55E-4BA7-B4DF-1A71DBC6ACC2}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSDataReportRuntimeLib.ExportFormats\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE7-47EB-101B-A3C9-08002B2F49FB}\ = "Common Dialog Help Property Page Object"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl\CurVer\ = "COMCTL.ProgCtrl.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYSINFO.SysInfo\ = "Microsoft SysInfo Control, version 6.0 (SP6)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E0750C-BA0A-11D1-B137-0000F8753F5D}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF3626A0-1B7B-11CF-9D53-00AA003C9CB6}\ = "IUpDown"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{27395F88-0C0C-101B-A3C9-08002B2F49FB}\1.1\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID\ = "COMCTL.ImageListCtrl"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{00028C00-0000-0000-0000-000000000046}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\InprocServer32\ = "C:\\Windows\\SysWOW64\\comctl32.ocx"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{20DD1B9B-87C4-11D1-8BE3-0000F8754DA1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{193556D4-4486-11D1-9C70-00C04FB987DF}\ = "_IWebEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\Control	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1741EF6-FFC6-11D0-BD02-00C04FC2FB86}\TypeLib\ = "{6B263850-900B-11D0-9484-00A0C91110ED}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "C:\\Windows\\SysWOW64\\comctl32.ocx"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{67397AA3-7FB1-11D0-B148-00A0C922E820}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B025F5-F551-44A9-8BA8-0118EFB9127C}\TypeLib\ = "{65E121D4-0C60-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E07502-BA0A-11D1-B137-0000F8753F5D}\ = "IVcSeriesPosition"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\MiscStatus	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A0E7BF67-8D30-4620-8825-7111714C7CAB}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\MiscStatus\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{198887E6-AC76-11D0-A77C-00A024A55AB0}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CEDFFAFD-3C2F-4552-9FD3-3DC4299057FD}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CFA7636D-CAA1-4F18-868F-8720624C8B86}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\TypeLib	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

pid	Process
3320	reg.exe
2416	reg.exe
2336	reg.exe
4420	reg.exe
3028	reg.exe
4664	reg.exe
2120	reg.exe
3688	reg.exe
3956	reg.exe
932	reg.exe
3388	reg.exe
3396	reg.exe
3936	reg.exe
2672	reg.exe
3364	reg.exe
1036	reg.exe
4836	reg.exe
1120	reg.exe
1936	reg.exe
1216	reg.exe
5020	reg.exe
1016	reg.exe
4512	reg.exe
3348	reg.exe
1556	reg.exe
2956	reg.exe
548	reg.exe
4268	reg.exe
2212	reg.exe
2120	reg.exe
2308	reg.exe
4608	reg.exe
2564	reg.exe
4480	reg.exe
2840	reg.exe
3408	reg.exe
4376	reg.exe
5040	reg.exe
4376	reg.exe
3596	reg.exe
1340	reg.exe
4224	reg.exe
2384	reg.exe
4360	reg.exe
3960	reg.exe
1736	reg.exe
2196	reg.exe
5064	reg.exe
2996	reg.exe
2920	reg.exe
2220	reg.exe
3216	reg.exe
3980	reg.exe
668	reg.exe
5076	reg.exe
4936	reg.exe
2012	reg.exe
4456	reg.exe
2660	reg.exe
5056	reg.exe
868	reg.exe
3792	reg.exe
4740	reg.exe
4640	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe
728	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3092	WMIC.exe
Token: SeSecurityPrivilege	3092	WMIC.exe
Token: SeTakeOwnershipPrivilege	3092	WMIC.exe
Token: SeLoadDriverPrivilege	3092	WMIC.exe
Token: SeSystemProfilePrivilege	3092	WMIC.exe
Token: SeSystemtimePrivilege	3092	WMIC.exe
Token: SeProfSingleProcessPrivilege	3092	WMIC.exe
Token: SeIncBasePriorityPrivilege	3092	WMIC.exe
Token: SeCreatePagefilePrivilege	3092	WMIC.exe
Token: SeBackupPrivilege	3092	WMIC.exe
Token: SeRestorePrivilege	3092	WMIC.exe
Token: SeShutdownPrivilege	3092	WMIC.exe
Token: SeDebugPrivilege	3092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3092	WMIC.exe
Token: SeRemoteShutdownPrivilege	3092	WMIC.exe
Token: SeUndockPrivilege	3092	WMIC.exe
Token: SeManageVolumePrivilege	3092	WMIC.exe
Token: 33	3092	WMIC.exe
Token: 34	3092	WMIC.exe
Token: 35	3092	WMIC.exe
Token: 36	3092	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3092	WMIC.exe
Token: SeSecurityPrivilege	3092	WMIC.exe
Token: SeTakeOwnershipPrivilege	3092	WMIC.exe
Token: SeLoadDriverPrivilege	3092	WMIC.exe
Token: SeSystemProfilePrivilege	3092	WMIC.exe
Token: SeSystemtimePrivilege	3092	WMIC.exe
Token: SeProfSingleProcessPrivilege	3092	WMIC.exe
Token: SeIncBasePriorityPrivilege	3092	WMIC.exe
Token: SeCreatePagefilePrivilege	3092	WMIC.exe
Token: SeBackupPrivilege	3092	WMIC.exe
Token: SeRestorePrivilege	3092	WMIC.exe
Token: SeShutdownPrivilege	3092	WMIC.exe
Token: SeDebugPrivilege	3092	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3092	WMIC.exe
Token: SeRemoteShutdownPrivilege	3092	WMIC.exe
Token: SeUndockPrivilege	3092	WMIC.exe
Token: SeManageVolumePrivilege	3092	WMIC.exe
Token: 33	3092	WMIC.exe
Token: 34	3092	WMIC.exe
Token: 35	3092	WMIC.exe
Token: 36	3092	WMIC.exe
Token: SeBackupPrivilege	2404	vssvc.exe
Token: SeRestorePrivilege	2404	vssvc.exe
Token: SeAuditPrivilege	2404	vssvc.exe
Token: SeShutdownPrivilege	2236	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	2236	vcredist_x64.exe
Token: SeSecurityPrivilege	728	msiexec.exe
Token: SeCreateTokenPrivilege	2236	vcredist_x64.exe
Token: SeAssignPrimaryTokenPrivilege	2236	vcredist_x64.exe
Token: SeLockMemoryPrivilege	2236	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	2236	vcredist_x64.exe
Token: SeMachineAccountPrivilege	2236	vcredist_x64.exe
Token: SeTcbPrivilege	2236	vcredist_x64.exe
Token: SeSecurityPrivilege	2236	vcredist_x64.exe
Token: SeTakeOwnershipPrivilege	2236	vcredist_x64.exe
Token: SeLoadDriverPrivilege	2236	vcredist_x64.exe
Token: SeSystemProfilePrivilege	2236	vcredist_x64.exe
Token: SeSystemtimePrivilege	2236	vcredist_x64.exe
Token: SeProfSingleProcessPrivilege	2236	vcredist_x64.exe
Token: SeIncBasePriorityPrivilege	2236	vcredist_x64.exe
Token: SeCreatePagefilePrivilege	2236	vcredist_x64.exe
Token: SeCreatePermanentPrivilege	2236	vcredist_x64.exe
Token: SeBackupPrivilege	2236	vcredist_x64.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
432	Visual C++ AIO.exe
5092	vcredist_x86.exe
2364	vcredist_x64.exe
4956	vcredist_x86.exe
3676	vcredist_x64.exe
4512	VC_redist.x86.exe
1984	VC_redist.x64.exe
4192	msiexec.exe
4192	msiexec.exe
4236	msiexec.exe
4236	msiexec.exe
4924	msiexec.exe
4924	msiexec.exe
3440	msiexec.exe
3440	msiexec.exe
2424	msiexec.exe
2424	msiexec.exe
3556	msiexec.exe
3556	msiexec.exe
3340	msiexec.exe
3340	msiexec.exe
3028	msiexec.exe
3028	msiexec.exe
4336	msiexec.exe
4336	msiexec.exe
2716	msiexec.exe
2716	msiexec.exe
3508	msiexec.exe
3508	msiexec.exe
1624	msiexec.exe
1624	msiexec.exe
3444	msiexec.exe
3444	msiexec.exe
2348	msiexec.exe
2348	msiexec.exe
5036	msiexec.exe
5036	msiexec.exe
916	msiexec.exe
916	msiexec.exe
1716	msiexec.exe
1716	msiexec.exe
2328	msiexec.exe
2328	msiexec.exe
4668	msiexec.exe
4668	msiexec.exe
2840	msiexec.exe
2840	msiexec.exe
2428	msiexec.exe
2428	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
4224	msiexec.exe
4224	msiexec.exe
3992	msiexec.exe
3992	msiexec.exe
2212	msiexec.exe
2212	msiexec.exe
2696	msiexec.exe
2696	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
2056	msiexec.exe
2056	msiexec.exe
4416	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2216	432	Visual C++ AIO.exe	86
PID 432 wrote to memory of 2216	432	Visual C++ AIO.exe	86
PID 432 wrote to memory of 2216	432	Visual C++ AIO.exe	86
PID 2216 wrote to memory of 2116	2216	cmd.exe	88
PID 2216 wrote to memory of 2116	2216	cmd.exe	88
PID 2216 wrote to memory of 2116	2216	cmd.exe	88
PID 2116 wrote to memory of 2132	2116	cmd.exe	89
PID 2116 wrote to memory of 2132	2116	cmd.exe	89
PID 2216 wrote to memory of 804	2216	cmd.exe	90
PID 2216 wrote to memory of 804	2216	cmd.exe	90
PID 2216 wrote to memory of 804	2216	cmd.exe	90
PID 2216 wrote to memory of 2504	2216	cmd.exe	91
PID 2216 wrote to memory of 2504	2216	cmd.exe	91
PID 2216 wrote to memory of 2420	2216	cmd.exe	92
PID 2216 wrote to memory of 2420	2216	cmd.exe	92
PID 2216 wrote to memory of 2420	2216	cmd.exe	92
PID 2216 wrote to memory of 2612	2216	cmd.exe	93
PID 2216 wrote to memory of 2612	2216	cmd.exe	93
PID 2216 wrote to memory of 3092	2216	cmd.exe	94
PID 2216 wrote to memory of 3092	2216	cmd.exe	94
PID 2216 wrote to memory of 4360	2216	cmd.exe	95
PID 2216 wrote to memory of 4360	2216	cmd.exe	95
PID 2216 wrote to memory of 836	2216	cmd.exe	97
PID 2216 wrote to memory of 836	2216	cmd.exe	97
PID 2216 wrote to memory of 836	2216	cmd.exe	97
PID 836 wrote to memory of 5000	836	cmd.exe	98
PID 836 wrote to memory of 5000	836	cmd.exe	98
PID 2216 wrote to memory of 2672	2216	cmd.exe	99
PID 2216 wrote to memory of 2672	2216	cmd.exe	99
PID 2216 wrote to memory of 2672	2216	cmd.exe	99
PID 2672 wrote to memory of 1244	2672	cmd.exe	100
PID 2672 wrote to memory of 1244	2672	cmd.exe	100
PID 2216 wrote to memory of 3936	2216	cmd.exe	101
PID 2216 wrote to memory of 3936	2216	cmd.exe	101
PID 2216 wrote to memory of 3936	2216	cmd.exe	101
PID 3936 wrote to memory of 4100	3936	cmd.exe	102
PID 3936 wrote to memory of 4100	3936	cmd.exe	102
PID 2216 wrote to memory of 2564	2216	cmd.exe	103
PID 2216 wrote to memory of 2564	2216	cmd.exe	103
PID 2216 wrote to memory of 4608	2216	cmd.exe	104
PID 2216 wrote to memory of 4608	2216	cmd.exe	104
PID 2216 wrote to memory of 5056	2216	cmd.exe	105
PID 2216 wrote to memory of 5056	2216	cmd.exe	105
PID 2216 wrote to memory of 1956	2216	cmd.exe	106
PID 2216 wrote to memory of 1956	2216	cmd.exe	106
PID 2216 wrote to memory of 3904	2216	cmd.exe	107
PID 2216 wrote to memory of 3904	2216	cmd.exe	107
PID 2216 wrote to memory of 3904	2216	cmd.exe	107
PID 3904 wrote to memory of 2328	3904	cmd.exe	108
PID 3904 wrote to memory of 2328	3904	cmd.exe	108
PID 2216 wrote to memory of 5080	2216	cmd.exe	109
PID 2216 wrote to memory of 5080	2216	cmd.exe	109
PID 2216 wrote to memory of 5080	2216	cmd.exe	109
PID 2216 wrote to memory of 2580	2216	cmd.exe	110
PID 2216 wrote to memory of 2580	2216	cmd.exe	110
PID 2216 wrote to memory of 2580	2216	cmd.exe	110
PID 2580 wrote to memory of 3112	2580	cmd.exe	111
PID 2580 wrote to memory of 3112	2580	cmd.exe	111
PID 2216 wrote to memory of 4548	2216	cmd.exe	112
PID 2216 wrote to memory of 4548	2216	cmd.exe	112
PID 2216 wrote to memory of 4548	2216	cmd.exe	112
PID 2216 wrote to memory of 3792	2216	cmd.exe	113
PID 2216 wrote to memory of 3792	2216	cmd.exe	113
PID 2216 wrote to memory of 3792	2216	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6GZ4B0XxJPfg\Requirement\Visual C++ AIO.exe
"C:\Users\Admin\AppData\Local\Temp\6GZ4B0XxJPfg\Requirement\Visual C++ AIO.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:2420
- - C:\Windows\system32\reg.exe
    reg.exe query "HKU\S-1-5-19"
    3⤵
    PID:2612
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:1244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:4100
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:2564
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:4608
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:5056
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3792
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      PID:3560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:808
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 42.34433.0
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:612
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1764
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:1416
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:556
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
    3⤵
    PID:1640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2840
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
    3⤵
    - Modifies registry key
    PID:3348
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:4164
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4376
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
    3⤵
    - Modifies registry key
    PID:4836
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:1736
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3408
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    PID:3028
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
    3⤵
    PID:3592
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
    3⤵
    PID:4104
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C2BB95AA-90F3-4891-81C1-A7E565BB836C} /v UninstallString
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{84E3E712-6343-484B-8B6C-9F145F019A70} /v UninstallString
    3⤵
    PID:2104
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    PID:1088
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:696
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:868
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2220
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1716
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1768
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 Redistributable" /s
    3⤵
    PID:3464
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4624
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2196
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1852
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1596
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1120
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2228
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1776
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    PID:4292
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3832
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:672
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4268
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1540
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4216
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3216
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2964
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2924
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    PID:2172
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1368
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3916
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3980
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4756
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2868
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:5064
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1800
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3128
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    PID:5040
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4980
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1792
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2336
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:804
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2504
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    PID:2768
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4544
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1576
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4360
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4720
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2660
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4252
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1932
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:668
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1004
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1564
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5056
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1956
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1036
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    PID:2364
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3904
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2308
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2212
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1668
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:540
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    PID:2184
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:748
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2120
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:404
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4872
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    PID:4080
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1160
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2540
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1556
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3324
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1688
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    PID:5096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1416
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1828
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    PID:2840
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1860
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2976
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4376
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4224
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:5076
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3036
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3320
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3388
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4948
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2648
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3596
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2036
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3984
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    PID:3772
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1716
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1768
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    PID:4624
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3464
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4640
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:3976
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3676
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{634A4654-4216-4CAE-94B5-7D2E4F2296D9} {DFECBDBA-D7AE-4C48-9AA7-21FFB1B23580} 3676
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:5092
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    PID:2056
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{5BC09FD2-C3CC-4A8B-BD0A-94992C415E2E} {359E8647-0964-4CDA-9DB4-EE0171A8AE04} 2236
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2364
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:4420
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5076
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{9EB2DAC7-F099-4D4B-BCA9-5E53220AFAEA} {5D749964-E33F-489A-9F29-1B15818753EA} 5076
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4956
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 1160
        5⤵
        Program crash
        
        PID:4800
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    - Modifies registry key
    PID:1936
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3124
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{E7509926-A67D-4CA2-BCF6-241409C28F4C} {733A0E8F-EBB8-4D5D-B3A2-26D13CBC0711} 3124
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:3676
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    - Modifies registry key
    PID:2308
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    PID:1340
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=532 -burn.filehandle.self=552 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:4512
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{7BD3DCD1-4CBF-4658-9258-96AFE621B403} {53BD87DC-F4C8-4FB7-ADE7-CB93744C892B} 4512
        5⤵
        Adds Run key to start application
        
        PID:4132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1120
        5⤵
        Program crash
        
        PID:1260
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    PID:2956
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:208
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=552 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:1984
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E40F0BA3-AF6D-447B-B371-831D5009DD91} {238AFC4D-F643-4037-9684-E6CE60432ADF} 1984
        5⤵
        Adds Run key to start application
        
        PID:4268
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    PID:704
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:1944
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1216
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4192
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    PID:3468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    PID:3976
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{B175520C-86A2-35A7-8619-86DC379688B9} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4236
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /f
    3⤵
    PID:1856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5020
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4924
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /f
    3⤵
    - Modifies registry key
    PID:3028
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
    3⤵
    PID:3616
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5040
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3440
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /f
    3⤵
    PID:4640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3320
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{BF08E976-B92E-4336-B56F-2171179476C4} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2424
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /f
    3⤵
    - Modifies registry key
    PID:4936
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
    3⤵
    PID:2920
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3556
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /f
    3⤵
    - Modifies registry key
    PID:2996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3640
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    PID:2356
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
    3⤵
    PID:1340
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
    3⤵
    - Modifies registry key
    PID:868
- - C:\Windows\system32\find.exe
    find /i "TRIN_TRIR_SETUP"
    3⤵
    PID:3956
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2956
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1852
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2200
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:3468
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:1036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:5092
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:1516
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2868
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:4356
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
    3⤵
    PID:1568
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2012
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
    3⤵
    - Modifies registry key
    PID:4608
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:776
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    PID:5056
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
    3⤵
    - Modifies registry key
    PID:4456
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:4548
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2416
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3792
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
    3⤵
    PID:3036
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4740
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{382F1166-A409-4C5B-9B1E-85ED538B8291} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3960
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E1902FC6-C423-4719-AB8A-AC7B2694B367} /v UninstallString
    3⤵
    PID:1692
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3396
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4080
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2184
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    PID:4444
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1088
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3616
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4664
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5036
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1860
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1736
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1132
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4076
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:548
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:540
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3592
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4640
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1984
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3320
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2120
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3984
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2984
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2564
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2660
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3264
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1016
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3408
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:212
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3936
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2580
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3628
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2920
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4104
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2208
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2672
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4980
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3428
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3364
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2428
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4512
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3852
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3132
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1340
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1164
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:868
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3688
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1580
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1852
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4224
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4784
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4964
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:2724
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1036
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:3340
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:2384
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3028
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4336
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2716
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3508
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1624
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3444
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2348
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:5036
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:916
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1716
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2328
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4668
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2840
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2428
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2032
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4224
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3992
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2212
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2696
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4480
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:3956
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:932
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:1620
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2056
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4416

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:728
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 4C07101BC49CCA0E055EA7156D7E74F2
  2⤵
  - Loads dropped DLL
  PID:3680
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D7E7791C9F78C4612290E0A2E03F30DC
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E68C031039F254411376218D25DEC076
  2⤵
  - Loads dropped DLL
  PID:3396
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 74EAF7DE9C15102BF2C4AF0B132C75FD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1148
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04123E5307443EFE4809C8AE060FEFFC
  2⤵
  - Loads dropped DLL
  PID:3124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 07EE52E02919B2C344D903EEBE6B6ECD
  2⤵
  - Loads dropped DLL
  PID:2116
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 95BD2DDF660469DA6DD8DFBD3DA619D6
  2⤵
  - Loads dropped DLL
  PID:4832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A4A02BB3708F7E85467476CDFCBA5514
  2⤵
  - Loads dropped DLL
  PID:2480
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD96E8E2598ACE7789DD66DE50AB1B7C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A26D8F212E2E3E16A4E035BC09C2F49F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3264
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1A746F1C83DCDD4CA4EF1DF3CD728F34
  2⤵
  - Loads dropped DLL
  PID:3444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0B73A4823C9079A382DCA51207C2F738 M Global\MSI0000
  2⤵
  PID:4740
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0D8ECB675FE93E538802E7D02B146A9E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:4336
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    - Drops file in Program Files directory
    PID:2716
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    - Drops file in Program Files directory
    PID:4076
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7FAF9BE470C471895D16C2B8F2BD882E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4132
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4216
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1132
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3176
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1136
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:452
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3144
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1668
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3640
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4132
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1040
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1004
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1532
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1620
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4800
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3616
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4328
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3364
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3680
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3976
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2376
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1456
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3440
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:808
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3320
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3092
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2660
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2892
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2872
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:100
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1852
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4300
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4480
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4760
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1432
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4720
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4424
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3404
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5000
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3856
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3144
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4104
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2236
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2200
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3916
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:4760
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4956 -ip 4956
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4512 -ip 4512
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery