3c188e4651bcc07df2bdb06d69585158797b1bafb91557b09217621628cd5b23

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	VisualCppRedist_AIO_x86_x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 64 IoCs

pid	Process
3800	vcredist_x86.exe
2944	vcredist_x64.exe
4968	vcredist_x86.exe
1044	vcredist_x64.exe
1540	vcredist_x86.exe
2332	vcredist_x64.exe
2392	VC_redist.x86.exe
224	vcredist_x86.exe
1800	VC_redist.x64.exe
4632	vcredist_x64.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
5056	VC_redist.x86.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
4308	VC_redist.x64.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
1408	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe
4164	MsiExec.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20260605142258.log\" /uninstall /passive /norestart ignored ignored /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20260605142311.log\" /uninstall /passive /norestart ignored ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20260605142311.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20260605142258.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100.dll	msiexec.exe
File created	C:\Windows\system32\vcomp110.dll	msiexec.exe
File created	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File created	C:\Windows\system32\mfcm120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc110cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm110u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcamp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\vcomp100.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp70.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\comdlg32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcomp120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File created	C:\Windows\system32\msvcp100.dll	msiexec.exe
File created	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc100enu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc71fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc100esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc110esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc100jpn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc70enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140cht.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msflxgrd.ocx	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140deu.dll	msiexec.exe
File created	C:\Windows\SysWOW64\richtx32.ocx	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc100cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc120kor.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msdatlst.ocx	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mscdrun.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER\mswcrun.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\InstallTemp\20260605142355022.1\9.0.30729.7523.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142355007.2\vcomp90.dll	msiexec.exe
File created	C:\Windows\Installer\e586bc7.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142407616.0\mfc80KOR.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\3PTFC3Q0RC\Microsoft.Office.Tools.Common.Implementation.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\CEDIM0BRBE\Microsoft.Office.Tools.Word.Implementation.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142354991.4\msvcp90.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI1AC9.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Installer\e586c60.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142352976.1\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\assembly\tmp\QIIG3N4P\Microsoft.Office.Tools.Outlook.Implementation.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100jpn_x86	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142352897.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_76a71f32.cat	msiexec.exe
File created	C:\Windows\Installer\e586bd6.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSIB545.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100rus_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID19A.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{010792BA-551A-3AC0-A7EF-0FAB4156C382}	msiexec.exe
File created	C:\Windows\Installer\e586bfc.msi	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\RDYYDZH59P\Microsoft.VisualStudio.Tools.Applications.Runtime.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260605142407663.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142409757.1\mfc90esp.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfcm100_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142355007.0\mfc90.dll	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CED.tmp	msiexec.exe
File created	C:\Windows\Installer\e586be7.msi	msiexec.exe
File created	C:\Windows\assembly\tmp\PKZD8JTV\Microsoft.Office.Tools.Common.Implementation.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100enu_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142352929.0\mfc80ESP.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142409757.1\mfc90esn.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\DUPSDOQC\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260605142352897.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142355007.1\mfc90esn.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260605142355007.3	msiexec.exe
File created	C:\Windows\Installer\e586bf4.msi	msiexec.exe
File created	C:\Windows\assembly\tmp\PL5Q7GO4\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\assembly\tmp\QJPXOZN9\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20260605142352913.0\amd64_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_478d9237.cat	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20260605142355007.4	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VisualCppRedist_AIO_x86_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8C344712-5FEC-11CF-A0BF-00AA0062BE57}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\AlternateCLSID = "{F65348F7-505D-4FAB-B66C-D76CFFC2BD78}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{43478D73-78E0-11CF-8E78-00A0D100038E}\AlternateCLSID = "{6785E9BB-087E-4772-8CA5-3331CC3B574E}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B}\AlternateCLSID = "{261399BF-4DBC-4731-B79F-EF8871D7CB36}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{21D93911-CB0F-11D0-84AC-00A0C90DC8A9}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}\AlternateCLSID = "{703EAF2B-FD9F-41BC-BB81-6C6757A46E5E}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{20C62CAB-15DA-101B-B9A8-444553540000}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{21D93913-CB0F-11D0-84AC-00A0C90DC8A9}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2B11E9B0-9F09-11D0-9484-00A0C91110ED}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{21D93911-CB0F-11D0-84AC-00A0C90DC8A9}\AlternateCLSID = "{20E72BC7-287F-4FCD-BFB7-156FF242C27C}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAB97084-FC6C-11D0-805D-00C04FB6C701}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{48E59293-9880-11CF-9754-00AA00C00908}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E35A5B50-1B6B-4C46-A323-42214F91F48B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CDE57A43-8B86-11D0-B3C6-00A0C90AEA82}\AlternateCLSID = "{225957BB-0005-48B9-8BFB-11AEE66779FB}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\AlternateCLSID = "{261399BF-4DBC-4731-B79F-EF8871D7CB36}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E8F8E80F-02EB-44CC-ABB5-6E5132BA6B24}\AlternateCLSID = "{962F28D6-107D-47A5-9515-2864454CFDD1}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\AlternateCLSID = "{D606EEC9-8368-4F10-88DB-BF5563EC36F6}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{026371C0-1B7C-11CF-9D53-00AA003C9CB6}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED}\AlternateCLSID = "{7E96FC67-468E-4E70-B246-D42078DD2361}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{601EB760-8909-11D0-9483-00A0C91110ED}\AlternateCLSID = "{E9AEB8A9-DB8B-425F-8133-69CA06187353}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D835690-900B-11D0-9484-00A0C91110ED}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0713E8D2-850A-101B-AFC0-4210102A8DA7}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\CLSID = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\AlternateCLSID = "{0B314611-2C19-4AB4-8513-A6EEA569D3C4}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6DB041E-66D0-48BC-8797-57C24F5C801C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6A227305-5C14-4EFD-AC52-516FE226F947}\AlternateCLSID = "{D8C1B55B-12DC-457F-97EC-4B84305FAA13}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{59245250-7A2F-11D0-9482-00A0C91110ED}\AlternateCLSID = "{4EE74AEC-8008-455E-AEC5-9726CF1E85BB}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{603C7E80-87C2-11D1-8BE3-0000F8754DA1}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6DB041E-66D0-48BC-8797-57C24F5C801C}\AlternateCLSID = "{62B025F5-F551-44A9-8BA8-0118EFB9127C}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D646316D-0915-421A-84C1-6A21C2495791}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{97992019-74A6-46C7-9CA3-7F8C0D39940B}\AlternateCLSID = "{29D5EC7E-6245-4DC9-9E53-A9A945AD4ABB}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3A08E130-8F65-11D0-9484-00A0C91110ED}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3B7C8860-D78F-101B-B9B5-04021C009402}\Compatibility Flags = "1024"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\45	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\46	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\49	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\43	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\49	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\47	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\47	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\48	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\45	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\4A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\46	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74DD2713-BA98-4D10-A16E-270BBEB9B555}\MiscStatus\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A948063-66C3-4F63-AB46-582EDAA35047}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00028C03-0000-0000-0000-000000000046}\ = "DBGrid Property Page 1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27F8FFB1-7406-11D1-B18C-00A0C922E820}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msadodc.ocx"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WebClassRuntime.WebClass.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E44F7BD4-3AB1-4D55-9190-FC53343AD2D2}\MiscStatus	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{44E266A2-CD46-47A0-9ED5-EEEC5F0C2A6E}\VersionIndependentProgID\ = "COMCTL.TabStrip"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2BEC8FA8-1193-4A15-B8AF-C6DF6E6930C7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E304B70C-0FCE-4E1B-9C81-CDAAD9F7DA55}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSComctlLib.ProgCtrl\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WebClassRuntime.WebClass.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6DB041E-66D0-48BC-8797-57C24F5C801C}\MiscStatus\1\ = "131473"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D624E3E0-720A-11CF-8136-00AA00C14959}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{3D8152C1-0CFD-4968-9684-794046886E31}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5E71F04F-551F-11CF-8152-00AA00A40C25}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{38911D8D-E448-11D0-84A3-00DD01104159}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E791964C-208A-11CF-8146-00AA00A40C25}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{29D5EC7E-6245-4DC9-9E53-A9A945AD4ABB}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E9E07525-BA0A-11D1-B137-0000F8753F5D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v12	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{760681E7-B985-41CE-BCBE-2985A1DFC61C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5DE2B62-FC3A-11D0-9C54-00C04FB987DF}\ = "_IWebItem"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{198887E2-AC76-11D0-A77C-00A024A55AB0}\2.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\DESIGNER\\mswcrun.dll\\2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\COMCTL.ProgCtrl\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{6FBA474E-43AC-11CE-9A0E-00AA0062BB4C}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{80B51087-CE4C-4FAE-8401-B6B3809DD234}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074E6-BA0A-11D1-B137-0000F8753F5D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0D2F21C-CCB0-11D0-A316-00AA00688B10}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1E216240-1B7D-11CF-9D53-00AA003C9CB6}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{642AC766-AAB4-11D0-8494-00A0C90DC8A9}\TypeLib\ = "{642AC760-AAB4-11D0-8494-00A0C90DC8A9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D8C1B55B-12DC-457F-97EC-4B84305FAA13}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074EE-BA0A-11D1-B137-0000F8753F5D}\ = "IVcLightSources"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{99E0D1EC-0A0D-4E50-B8A1-82A8B6ECE5CB}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\ProgId\ = "bootstrap.vsto.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{38911D8E-E448-11D0-84A3-00DD01104159}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{62B025F5-F551-44A9-8BA8-0118EFB9127C}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\55AFD0A51583CB54B80259AEB45F18D2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{5522DB03-06D6-11D2-8D70-00A0C98B28E2}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{99FF4677-FFC3-11D0-BD02-00C04FC2FB86}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\MiscStatus\1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7F1602-D44C-11D0-A7D9-AE3D17000000}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{27395F85-0C0C-101B-A3C9-08002B2F49FB}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{F0D2F211-CCB0-11D0-A316-00AA00688B10}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{642AC766-AAB4-11D0-8494-00A0C90DC8A9}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msdbrptr.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DHTMLPageDesigner.DHTMLPageRuntimeWinEvent\ = "DHTMLPageRuntimeWinEvent Object"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6E5311A1-325D-4FFD-9AF4-B373F02AE458}\MiscStatus\1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9E074E4-BA0A-11D1-B137-0000F8753F5D}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B7C8860-D78F-101B-B9B5-04021C009402}\MiscStatus\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0ECD9B62-23AA-11D0-B351-00A0C9055D8E}\TypeLib\Version = "6.0"	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

pid	Process
4108	reg.exe
224	reg.exe
2184	reg.exe
1796	reg.exe
1348	reg.exe
5036	reg.exe
4952	reg.exe
4492	reg.exe
1892	reg.exe
4792	reg.exe
3844	reg.exe
1044	reg.exe
4380	reg.exe
4612	reg.exe
3272	reg.exe
3824	reg.exe
756	reg.exe
4196	reg.exe
3820	reg.exe
3800	reg.exe
2096	reg.exe
1220	reg.exe
1220	reg.exe
4768	reg.exe
4948	reg.exe
4500	reg.exe
4384	reg.exe
2184	reg.exe
1788	reg.exe
2964	reg.exe
2584	reg.exe
2896	reg.exe
3904	reg.exe
4796	reg.exe
3124	reg.exe
4708	reg.exe
3696	reg.exe
4696	reg.exe
1040	reg.exe
4492	reg.exe
5080	reg.exe
2532	reg.exe
3296	reg.exe
3868	reg.exe
2180	reg.exe
4384	reg.exe
2592	reg.exe
4400	reg.exe
4612	reg.exe
1728	reg.exe
4784	reg.exe
3140	reg.exe
4244	reg.exe
1408	reg.exe
2572	reg.exe
4668	reg.exe
4384	reg.exe
1800	reg.exe
2136	reg.exe
2120	reg.exe
4420	reg.exe
2996	reg.exe
4984	reg.exe
4700	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe
4808	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4984	WMIC.exe
Token: SeSecurityPrivilege	4984	WMIC.exe
Token: SeTakeOwnershipPrivilege	4984	WMIC.exe
Token: SeLoadDriverPrivilege	4984	WMIC.exe
Token: SeSystemProfilePrivilege	4984	WMIC.exe
Token: SeSystemtimePrivilege	4984	WMIC.exe
Token: SeProfSingleProcessPrivilege	4984	WMIC.exe
Token: SeIncBasePriorityPrivilege	4984	WMIC.exe
Token: SeCreatePagefilePrivilege	4984	WMIC.exe
Token: SeBackupPrivilege	4984	WMIC.exe
Token: SeRestorePrivilege	4984	WMIC.exe
Token: SeShutdownPrivilege	4984	WMIC.exe
Token: SeDebugPrivilege	4984	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4984	WMIC.exe
Token: SeRemoteShutdownPrivilege	4984	WMIC.exe
Token: SeUndockPrivilege	4984	WMIC.exe
Token: SeManageVolumePrivilege	4984	WMIC.exe
Token: 33	4984	WMIC.exe
Token: 34	4984	WMIC.exe
Token: 35	4984	WMIC.exe
Token: 36	4984	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4984	WMIC.exe
Token: SeSecurityPrivilege	4984	WMIC.exe
Token: SeTakeOwnershipPrivilege	4984	WMIC.exe
Token: SeLoadDriverPrivilege	4984	WMIC.exe
Token: SeSystemProfilePrivilege	4984	WMIC.exe
Token: SeSystemtimePrivilege	4984	WMIC.exe
Token: SeProfSingleProcessPrivilege	4984	WMIC.exe
Token: SeIncBasePriorityPrivilege	4984	WMIC.exe
Token: SeCreatePagefilePrivilege	4984	WMIC.exe
Token: SeBackupPrivilege	4984	WMIC.exe
Token: SeRestorePrivilege	4984	WMIC.exe
Token: SeShutdownPrivilege	4984	WMIC.exe
Token: SeDebugPrivilege	4984	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4984	WMIC.exe
Token: SeRemoteShutdownPrivilege	4984	WMIC.exe
Token: SeUndockPrivilege	4984	WMIC.exe
Token: SeManageVolumePrivilege	4984	WMIC.exe
Token: 33	4984	WMIC.exe
Token: 34	4984	WMIC.exe
Token: 35	4984	WMIC.exe
Token: 36	4984	WMIC.exe
Token: SeBackupPrivilege	748	vssvc.exe
Token: SeRestorePrivilege	748	vssvc.exe
Token: SeAuditPrivilege	748	vssvc.exe
Token: SeShutdownPrivilege	872	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	872	vcredist_x86.exe
Token: SeSecurityPrivilege	4808	msiexec.exe
Token: SeCreateTokenPrivilege	872	vcredist_x86.exe
Token: SeAssignPrimaryTokenPrivilege	872	vcredist_x86.exe
Token: SeLockMemoryPrivilege	872	vcredist_x86.exe
Token: SeIncreaseQuotaPrivilege	872	vcredist_x86.exe
Token: SeMachineAccountPrivilege	872	vcredist_x86.exe
Token: SeTcbPrivilege	872	vcredist_x86.exe
Token: SeSecurityPrivilege	872	vcredist_x86.exe
Token: SeTakeOwnershipPrivilege	872	vcredist_x86.exe
Token: SeLoadDriverPrivilege	872	vcredist_x86.exe
Token: SeSystemProfilePrivilege	872	vcredist_x86.exe
Token: SeSystemtimePrivilege	872	vcredist_x86.exe
Token: SeProfSingleProcessPrivilege	872	vcredist_x86.exe
Token: SeIncBasePriorityPrivilege	872	vcredist_x86.exe
Token: SeCreatePagefilePrivilege	872	vcredist_x86.exe
Token: SeCreatePermanentPrivilege	872	vcredist_x86.exe
Token: SeBackupPrivilege	872	vcredist_x86.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1456	VisualCppRedist_AIO_x86_x64.exe
3800	vcredist_x86.exe
3800	vcredist_x86.exe
2944	vcredist_x64.exe
4968	vcredist_x86.exe
1044	vcredist_x64.exe
1540	vcredist_x86.exe
2332	vcredist_x64.exe
2392	VC_redist.x86.exe
224	vcredist_x86.exe
1800	VC_redist.x64.exe
4632	vcredist_x64.exe
1164	msiexec.exe
5056	VC_redist.x86.exe
1164	msiexec.exe
2704	msiexec.exe
4308	VC_redist.x64.exe
2704	msiexec.exe
388	msiexec.exe
388	msiexec.exe
4612	msiexec.exe
4612	msiexec.exe
3588	msiexec.exe
3588	msiexec.exe
4528	msiexec.exe
4528	msiexec.exe
1408	msiexec.exe
1408	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2960	msiexec.exe
2960	msiexec.exe
4380	msiexec.exe
4380	msiexec.exe
4528	msiexec.exe
4528	msiexec.exe
3440	msiexec.exe
3440	msiexec.exe
2944	msiexec.exe
2944	msiexec.exe
3848	msiexec.exe
3848	msiexec.exe
2584	msiexec.exe
2584	msiexec.exe
3420	msiexec.exe
3420	msiexec.exe
980	msiexec.exe
980	msiexec.exe
3260	msiexec.exe
3260	msiexec.exe
3512	msiexec.exe
3512	msiexec.exe
1756	msiexec.exe
1756	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe
2800	msiexec.exe
2800	msiexec.exe
2168	msiexec.exe
2168	msiexec.exe
4800	msiexec.exe
4800	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 876	1456	VisualCppRedist_AIO_x86_x64.exe	98
PID 876 wrote to memory of 2016	876	cmd.exe	100
PID 2016 wrote to memory of 3776	2016	cmd.exe	101
PID 876 wrote to memory of 1200	876	cmd.exe	102
PID 876 wrote to memory of 2964	876	cmd.exe	103
PID 876 wrote to memory of 640	876	cmd.exe	104
PID 876 wrote to memory of 4424	876	cmd.exe	105
PID 876 wrote to memory of 4984	876	cmd.exe	106
PID 876 wrote to memory of 1384	876	cmd.exe	107
PID 876 wrote to memory of 1376	876	cmd.exe	108
PID 1376 wrote to memory of 4792	1376	cmd.exe	109
PID 876 wrote to memory of 764	876	cmd.exe	110
PID 764 wrote to memory of 1492	764	cmd.exe	111
PID 876 wrote to memory of 2496	876	cmd.exe	113
PID 2496 wrote to memory of 4544	2496	cmd.exe	114
PID 876 wrote to memory of 672	876	cmd.exe	116
PID 876 wrote to memory of 4580	876	cmd.exe	117
PID 876 wrote to memory of 3416	876	cmd.exe	118
PID 876 wrote to memory of 2856	876	cmd.exe	119
PID 876 wrote to memory of 4924	876	cmd.exe	120
PID 4924 wrote to memory of 3296	4924	cmd.exe	234
PID 876 wrote to memory of 3292	876	cmd.exe	122
PID 876 wrote to memory of 2256	876	cmd.exe	123
PID 2256 wrote to memory of 4708	2256	cmd.exe	241
PID 876 wrote to memory of 2848	876	cmd.exe	125
PID 876 wrote to memory of 2452	876	cmd.exe	126
PID 2452 wrote to memory of 3148	2452	cmd.exe	127
PID 876 wrote to memory of 3884	876	cmd.exe	188
PID 876 wrote to memory of 984	876	cmd.exe	129
PID 984 wrote to memory of 1032	984	cmd.exe	130
PID 876 wrote to memory of 4688	876	cmd.exe	131
PID 876 wrote to memory of 5036	876	cmd.exe	132
PID 876 wrote to memory of 2112	876	cmd.exe	133
PID 876 wrote to memory of 2660	876	cmd.exe	218
PID 876 wrote to memory of 4152	876	cmd.exe	135
PID 876 wrote to memory of 2960	876	cmd.exe	136
PID 876 wrote to memory of 3324	876	cmd.exe	137
PID 876 wrote to memory of 3336	876	cmd.exe	138
PID 876 wrote to memory of 2572	876	cmd.exe	253
PID 876 wrote to memory of 4384	876	cmd.exe	140
PID 876 wrote to memory of 5080	876	cmd.exe	141
PID 876 wrote to memory of 4308	876	cmd.exe	142
PID 876 wrote to memory of 3380	876	cmd.exe	143
PID 876 wrote to memory of 4196	876	cmd.exe	144
PID 876 wrote to memory of 1796	876	cmd.exe	145
PID 876 wrote to memory of 4204	876	cmd.exe	146
PID 876 wrote to memory of 2184	876	cmd.exe	204
PID 876 wrote to memory of 3536	876	cmd.exe	148
PID 876 wrote to memory of 1800	876	cmd.exe	149
PID 876 wrote to memory of 2180	876	cmd.exe	150
PID 876 wrote to memory of 1408	876	cmd.exe	151
PID 876 wrote to memory of 1468	876	cmd.exe	152
PID 876 wrote to memory of 4492	876	cmd.exe	153
PID 876 wrote to memory of 4640	876	cmd.exe	154
PID 876 wrote to memory of 4248	876	cmd.exe	212
PID 876 wrote to memory of 3032	876	cmd.exe	156
PID 876 wrote to memory of 1728	876	cmd.exe	213
PID 876 wrote to memory of 4252	876	cmd.exe	158
PID 876 wrote to memory of 4420	876	cmd.exe	159
PID 876 wrote to memory of 756	876	cmd.exe	216
PID 876 wrote to memory of 4172	876	cmd.exe	161
PID 876 wrote to memory of 1220	876	cmd.exe	162
PID 876 wrote to memory of 4652	876	cmd.exe	163
PID 876 wrote to memory of 4108	876	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe
"C:\Users\Admin\AppData\Local\Temp\VisualCppRedist_AIO_x86_x64.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:3776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    PID:1200
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:640
- - C:\Windows\system32\reg.exe
    reg.exe query "HKU\S-1-5-19"
    3⤵
    PID:4424
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:4544
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:672
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:4580
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:3416
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      PID:3296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      PID:4708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      PID:3148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      PID:1032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 50.35719.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:5036
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2660
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:3336
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:2572
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4384
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    - Modifies registry key
    PID:5080
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\6E815EB96CCE9A53884E7857C57002F0
    3⤵
    PID:4308
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:3380
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4196
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A
    3⤵
    - Modifies registry key
    PID:1796
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:4204
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2184
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    PID:3536
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8122DAB1-ED4D-3676-BB0A-CA368196543E} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D401961D-3A20-3AC7-943B-6139D5BD490A} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2180
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1408
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{773AD50D-AAE6-4BA1-AD01-B5A38874C840} /v UninstallString
    3⤵
    PID:1468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4492
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4640
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4248
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    PID:3032
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1728
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4420
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:756
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4172
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1220
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4652
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4108
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3868
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2964
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4392
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4984
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1384
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1892
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4368
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3872
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    PID:4400
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2084
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:672
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    PID:3416
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2856
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4124
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:1788
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2996
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4708
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3352
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3528
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    PID:1380
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4668
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3884
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    PID:5096
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3124
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4412
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    PID:2332
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:644
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2772
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    PID:2960
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3324
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5056
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4384
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4648
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2456
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    PID:4020
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4608
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3464
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2184
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1912
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2068
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4796
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1408
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    PID:868
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3604
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4248
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1728
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4504
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:400
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:756
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4488
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2660
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3904
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1220
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4424
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    PID:3200
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3868
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4352
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4792
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1384
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3824
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4368
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1572
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2532
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4400
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2132
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3296
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3416
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3420
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2996
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1788
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1344
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    PID:3352
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4708
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4668
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1380
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:948
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3124
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5096
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2056
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015-2026 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3696
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:924
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3744
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ v14 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4612
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2572
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:4648
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:872
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{E2AE190B-8B2A-4E3C-B3C2-2BA41FE4E01A} {3E3EBD3D-C2EB-410B-8345-5FC1644B5680} 872
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3800
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    PID:384
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    PID:2576
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{DC395EE0-DD64-4C44-BCA6-256DE3A6D322} {7D1F0561-A65E-4C03-9D6D-EE353C8AACF5} 2576
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2944
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:1348
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1780
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{9D079BC6-7951-4F6A-800F-AEB9607D18D4} {A3C8D979-B00E-4BF8-8A24-81718DB8DE65} 1780
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4968
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    PID:1592
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2288
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{292BA5E7-32A4-4C41-A4B1-065DBD36A241} {5E319141-465B-49F8-960E-822723990E0E} 2288
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:1044
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    - Modifies registry key
    PID:3844
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    PID:3556
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=556 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:2392
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{714A0091-8AD8-4574-908C-959F9FCB4F6D} {305AD1BD-6CF5-4DC3-A398-71B475D0FB9A} 2392
        5⤵
        Adds Run key to start application
        
        PID:3744
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:4700
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    PID:4608
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=556 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:1800
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2D1E8E8C-6141-4783-80E7-5F900510EBD5} {01E75DB7-2110-4325-B3BE-B7560BF15CBB} 1800
        5⤵
        Adds Run key to start application
        
        PID:4948
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    PID:3744
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:4936
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /v UninstallString
    3⤵
    PID:4188
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:1164
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    PID:1324
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4768
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2704
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    PID:4344
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{B175520C-86A2-35A7-8619-86DC379688B9} /v UninstallString
    3⤵
    PID:3464
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1044
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7DAD0258-515C-3DD4-8964-BD714199E0F7} /v UninstallString
    3⤵
    PID:224
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4380
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BF08E976-B92E-4336-B56F-2171179476C4} /v UninstallString
    3⤵
    PID:1036
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4244
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{610487D9-3460-328A-9333-219D43A75CC5} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4696
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C
    3⤵
    - Modifies registry key
    PID:2136
- - C:\Windows\system32\find.exe
    find /i "TRIN_TRIR_SETUP"
    3⤵
    PID:4936
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual Studio 2010 Tools for Office Runtime *Redistributable" /s
    3⤵
    PID:5000
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3324
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:3784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.50727.6229"
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4404
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" dir /b "C:\Windows\WinSxS\Fusion\amd64_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_*" 2>nul"
    3⤵
    PID:3724
- - C:\Windows\system32\findstr.exe
    findstr /v /c:"0.30729.7523"
    3⤵
    PID:5100
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4948
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2584
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D
    3⤵
    - Modifies registry key
    PID:3820
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:1044
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    PID:1220
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F
    3⤵
    PID:4492
- - C:\Windows\system32\find.exe
    find /i "VC_RED_enu_"
    3⤵
    PID:420
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97} /v UninstallString
    3⤵
    PID:4468
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37B8F9C7-03FB-3253-8781-2517C99D7C00} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4784
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53CF6934-A98D-3D84-9146-FC4EDF3D5641} /v UninstallString
    3⤵
    PID:3848
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{010792BA-551A-3AC0-A7EF-0FAB4156C382} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1040
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{61B44572-8722-4DAF-8ACF-8E742D30BCC5} /v UninstallString
    3⤵
    PID:3140
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF} /v UninstallString
    3⤵
    PID:3832
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2005 *Redistributable" /s
    3⤵
    PID:3124
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3348
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3568
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2008 *Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4108
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2236
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4928
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2010 *Redistributable" /s
    3⤵
    PID:3984
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2572
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1524
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2896
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3672
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4700
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4612
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4400
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1052
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    PID:2960
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4196
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2120
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3272
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4968
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4948
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:224
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:388
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4380
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4492
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1408
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4640
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3140
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4432
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3832
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    PID:2168
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4188
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2856
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4244
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2136
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2772
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4500
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3336
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2456
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5036
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4584
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2428
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    PID:2524
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3784
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1056
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3800
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5056
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4164
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2120
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5100
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:384
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:4948
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2592
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:388
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:4400
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4952
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4612
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    - Modifies registry key
    PID:2572
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3588
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4528
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1408
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1708
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2632
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2960
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4380
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4528
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3440
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2944
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3848
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2584
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3420
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:980
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3260
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3512
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeMinimum_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:1756
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2026\x86\vc_runtimeAdditional_x86.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2856
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2800
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D391-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:1220
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:2096
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /v UninstallString
    3⤵
    - Modifies registry key
    PID:4384
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D392-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2168
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{C5E3A69D-D393-45A6-A8FB-00B01E2B010D} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4800
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vbc\vbcrun.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3712
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3416

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding E7F3181C3DE0D72FCA107E216AE2AF9E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2136
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding EDD96F6C860A7C4D2E87EFD46C3BB081
  2⤵
  - Loads dropped DLL
  PID:1984
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 6F60BDAA678579108341986ADCD51CEF
  2⤵
  - Loads dropped DLL
  PID:1408
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 1F35552A564A4B340CFBAD2AFA3DE9D8
  2⤵
  - Loads dropped DLL
  PID:4164
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 01A28AA1E0F2345A48B83910C19DF1C5
  2⤵
  PID:4584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9A4BB99CFDC4413C687AD568A3AAD484
  2⤵
  PID:3872
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F1D194441F62F6A95F4DB46A7C51EB59
  2⤵
  PID:4896
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 62BE6224FAF33FE7159180707B2C8D0F
  2⤵
  PID:3832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6419852969E5C62FF0A951A2E47E2FB2 M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 129025C58004BE02741DA90073EF59DA E Global\MSI0000
  2⤵
  PID:2660
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    PID:4384
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:4380
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1D8E025A8CEAD516156381D66178552B E Global\MSI0000
  2⤵
  PID:420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5040
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1164
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4344
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4280
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4248
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2340
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1432
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:224
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3436
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2380
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:632
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2696
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:388
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4308
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5000
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3712
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2340
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3812
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4208
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2596
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1420
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4824
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4432
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3064
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3604
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1036
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2696
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3272
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4108
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4792
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2856
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2524
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1432
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2120
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3512
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1652
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4288
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3436
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1356
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4248
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1676
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4308
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4368
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3464
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4824
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:5052
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1468
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2168
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3812
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4012
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4208
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2972
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:3180
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:1648

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605142258.log" /uninstall /passive /norestart ignored /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2056
- C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605142258.log /uninstall /passive /norestart ignored
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4888
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605142258.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{EBFB9711-BC98-4591-944E-A61DEBAAA4E1} {AA166012-93DD-4126-A6EE-4E375E403674} 4888
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1540

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605142311.log" /uninstall /passive /norestart ignored /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:1032
- C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605142311.log /uninstall /passive /norestart ignored
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2296
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605142311.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{97ADC40B-B6F4-4ED8-86AA-2446EC6843DE} {55912638-B84C-4A7F-A5AD-A45A50C27DEB} 2296
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2332

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:2532
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605142314.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1112
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605142314.log" -burn.unelevated BurnPipe.{4EA80312-46F3-44B6-B60F-FC71ABB126CB} {D603C11B-FF4E-4CBF-B0E7-9D097D1A7315} 1112
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:224

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /burn.runonce
1⤵
PID:1912
- C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605142317.log"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2128
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605142317.log" -burn.unelevated BurnPipe.{2D53C26C-AC23-4A7B-89E6-8AA2262676F0} {FA6A8F77-828A-4EFB-B229-6842D8B6916A} 2128
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4632

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
PID:5080
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605142321.log"
  2⤵
  PID:4648
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260605142321.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5056

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
PID:2084
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605142324.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4352
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260605142324.log"
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:4308

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery