de4f40cf15b6b8af2efd8905b3fd82180b108d67ab87d4e51bbbab528e253680

Resubmissions

02/07/2026, 17:07

260702-vm2khsav4t8

02/07/2026, 16:29

260702-ty9vlaex9n8

01/07/2026, 16:23

260701-tvy9pabx4w8

Analysis

user interaction
yes
max time kernel
113s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ComIntRep v11.1.3/ComIntRep_X64.exe
Size 2.2MB
Sample260702-vm2khsav4t
SHA256 de4f40cf15b6b8af2efd8905b3fd82180b108d67ab87d4e51bbbab528e253680
MD5 d00c97c4260bde717e484052f3ec66b3
SHA1 63b3477131792b047c05c4c586e81c1df67944db
SHA512 90fb32d779944ad9ef0f1b1fab33329fa14fcdba7d02a5156a769c32a148d360d3f98f9f3ff363f205a72ba99bd4bf1b1cdd8a404fd5538a33ec5c40ea5c2890
SSDEEP 49152:Z2EYTb8atv1orq+pEiSDTj1VyvBa/E/RsFKqyxfWjKPxnrGOhU+PCGT8ECh2L0l:4XbIrq6RsTyxfBir+KGeh2i
TLSH
T13FB5CE8A339042ADEE67D173C653C926D272BC495A76969F12E4BB772F732301A1F310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 44 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4\FuncName = "FormatPKIXEmailProtection"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32\FuncName = "FormatVerisignExtension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\FuncName = "EncodeAttrSequence"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\FuncName = "DecodeAttrSequence"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCertPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\FuncName = "DecodeAttrSequence"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\FuncName = "DecodeRecipientID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustInit"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4\FuncName = "EncodeRecipientID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.4\FuncName = "DecodeRecipientID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "WINTRUST.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustFinalPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32\FuncName = "FormatVerisignExtension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.32\Dll = "cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4\FuncName = "FormatPKIXEmailProtection"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.4\FuncName = "EncodeRecipientID"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$DLL = "Cryptdlg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustFinalPolicy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustInit"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCleanup"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\FuncName = "EncodeAttrSequence"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "WintrustCertificateTrust"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCertPolicy"	regsvr32.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5856	sc.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
968	regsvr32.exe
3848	regsvr32.exe
4440	regsvr32.exe
4836	regsvr32.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1144	ipconfig.exe
5816	ipconfig.exe
2428	ipconfig.exe
4496	ipconfig.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9230A21D-831D-414F-87F1-F0131A16A75A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B79841A-3F0E-4D72-BD22-97AAB8476BE1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52B14A6A-58F1-45BD-B00A-DCE7403D951E}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E249D3A-EC77-48E2-9DB1-45F11983EFBC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{244ED887-E63A-50C4-B946-BD76EB3280D4}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56ABDD06-2B36-4A92-B399-90369A10BA53}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8C87A7A-AB21-464A-89CE-D152348105C1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A561E69A-B4B8-4113-91A5-64C6BCCA3430}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07B3B2BA-90EE-4464-9F6F-A824B13B91C1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4F0FBF7-52EF-4E24-90B6-588FD681BBCC}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0E64BB19-ED60-458D-A97F-E65843AD2BC2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73EF35C2-3ADF-4AC8-8383-0850E26E9683}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7A25165A-86F1-4B4A-B1D2-E89650CD9589}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2804B74C-AC16-4398-9DC0-DB83F5B7ED14}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7C40885-2506-4EB9-B4AB-0E1E3D3FD5F9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2122B709-0B82-4A83-A1F9-C4B90E09CB4C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41FE86AF-F148-457E-B0EC-D0389FA74670}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30E038F9-64C9-4A5C-BA4C-F9F7DF30849C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D67E846-5B9C-4DB8-9CBC-DDE12F4254F1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF65A750-6F76-4B47-B603-C99692A7D5D8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E684F8FE-31A9-57DA-993F-06B5757F41F5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F9BAD1E-C1C4-46B4-A9EA-C8EC56D20357}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CEDAC0B3-E828-40CC-9E5C-E2F4E9B447C4}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A871910E-6CC0-4E65-8B9B-458CE9115E30}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E820910B-1910-404D-AFAF-5D7298B9B28D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59007C49-CB25-4BD5-AAD9-6943F08F4F9E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DEF89B4A-5804-456B-AF09-A8E4C80DE58D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{709D476B-6346-4085-AECA-21229553D396}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF8C9B9C-C90F-4F30-B5B2-77C3D56BD125}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A695888C-E3FE-47C2-82C0-CCD5890A243F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CFD6C07-1992-47BD-9B83-830B358B2DF4}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9DD5C44E-8D20-45A9-BFE3-645CEEBC2C9F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{894AA80C-9EA7-4E77-A1F4-D0D15A7C2225}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E000160D-DD29-4F11-B56F-4F2FDF75BC8B}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B155F51-7593-4458-B3BC-B196A750C014}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEE53265-5B70-401D-89E1-65DDBA58518E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E8FA6F3-A8BB-4BC6-A30C-89B6EEBB448C}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D770B2AD-8F5E-4B8E-B3DF-F05A2AB5287C}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11C4304D-0FAA-4C31-8BDD-4B0000C99472}\AsynchronousInterface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DDAF2D8-C38F-4638-95FC-FB9C6DDAE52F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{924CAE84-12C0-4F00-9ED6-9EC910300E96}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C32FA17-30A4-42D5-B7DA-FFE8FCFCCE45}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{342ECF84-D6D8-4EB5-9283-91A59D8A01F8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60CE96BB-B6F9-42DC-B84E-5E5D9C370A6F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{22C440DF-4720-4B3A-A472-0CCB6E6CDD97}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47EB80E1-78CD-4325-8D67-85BFFA376707}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD2D3DC4-03E6-49C5-9ACF-AD01AB648E99}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CAFD3F1-05D1-4D26-A32A-9907A72C920B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A6209FE-65B4-5F45-BFED-226E6D9F32EA}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4B2A4AF0-50DC-4266-B0AE-1D4013D069B7}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77D5D69C-D6CE-4026-B625-26964EEC733F}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56B32065-0BB3-42E2-975D-A559DE1316E8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{41FE86AF-F148-457E-B0EC-D0389FA74670}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46B7F8B4-7994-436D-9454-7966BB126D03}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44C09D56-8D3B-419D-A462-7B956B105B47}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A1BCB15-C19E-5EE1-AB67-D703FA807381}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BF992A9-AF7A-4DBA-B2E5-4D080B1ECBC6}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FF8C9B9C-C90F-4F30-B5B2-77C3D56BD125}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DEECAB6-1CFF-4923-9A53-BC2C5D199544}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FECE3DD3-B657-4FC1-B2DF-532A1BDF43AC}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E8FA6F3-A8BB-4BC6-A30C-89B6EEBB448C}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C77C8BAF-3273-4451-BE32-22E8DA094710}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C59A7A3C-0676-4526-8192-5D0BF9B89B95}	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3820	ComIntRep_X64.exe
3820	ComIntRep_X64.exe
3820	ComIntRep_X64.exe
3820	ComIntRep_X64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3820	ComIntRep_X64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4644	AUDIODG.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4464	3820	ComIntRep_X64.exe	90
PID 3820 wrote to memory of 5528	3820	ComIntRep_X64.exe	92
PID 5528 wrote to memory of 2688	5528	cmd.exe	94
PID 3820 wrote to memory of 2268	3820	ComIntRep_X64.exe	95
PID 2268 wrote to memory of 2464	2268	cmd.exe	97
PID 3820 wrote to memory of 1824	3820	ComIntRep_X64.exe	98
PID 1824 wrote to memory of 4860	1824	cmd.exe	100
PID 3820 wrote to memory of 1676	3820	ComIntRep_X64.exe	101
PID 1676 wrote to memory of 3952	1676	cmd.exe	103
PID 3820 wrote to memory of 4964	3820	ComIntRep_X64.exe	104
PID 4964 wrote to memory of 1144	4964	cmd.exe	106
PID 3820 wrote to memory of 5756	3820	ComIntRep_X64.exe	107
PID 5756 wrote to memory of 5816	5756	cmd.exe	109
PID 3820 wrote to memory of 5324	3820	ComIntRep_X64.exe	110
PID 5324 wrote to memory of 2428	5324	cmd.exe	112
PID 3820 wrote to memory of 2872	3820	ComIntRep_X64.exe	113
PID 2872 wrote to memory of 4496	2872	cmd.exe	115
PID 3820 wrote to memory of 4024	3820	ComIntRep_X64.exe	116
PID 4024 wrote to memory of 3716	4024	cmd.exe	118
PID 3820 wrote to memory of 4932	3820	ComIntRep_X64.exe	119
PID 3820 wrote to memory of 3140	3820	ComIntRep_X64.exe	120
PID 3820 wrote to memory of 5056	3820	ComIntRep_X64.exe	121
PID 3820 wrote to memory of 1656	3820	ComIntRep_X64.exe	122
PID 3820 wrote to memory of 1392	3820	ComIntRep_X64.exe	123
PID 3820 wrote to memory of 1496	3820	ComIntRep_X64.exe	124
PID 3820 wrote to memory of 2632	3820	ComIntRep_X64.exe	125
PID 3820 wrote to memory of 6060	3820	ComIntRep_X64.exe	126
PID 3820 wrote to memory of 752	3820	ComIntRep_X64.exe	127
PID 3820 wrote to memory of 2132	3820	ComIntRep_X64.exe	128
PID 3820 wrote to memory of 2772	3820	ComIntRep_X64.exe	129
PID 3820 wrote to memory of 1208	3820	ComIntRep_X64.exe	130
PID 3820 wrote to memory of 5224	3820	ComIntRep_X64.exe	131
PID 3820 wrote to memory of 2796	3820	ComIntRep_X64.exe	132
PID 3820 wrote to memory of 1020	3820	ComIntRep_X64.exe	133
PID 3820 wrote to memory of 2892	3820	ComIntRep_X64.exe	134
PID 3820 wrote to memory of 2420	3820	ComIntRep_X64.exe	135
PID 3820 wrote to memory of 6048	3820	ComIntRep_X64.exe	136
PID 6048 wrote to memory of 1220	6048	regsvr32.exe	137
PID 3820 wrote to memory of 5404	3820	ComIntRep_X64.exe	138
PID 3820 wrote to memory of 4476	3820	ComIntRep_X64.exe	139
PID 3820 wrote to memory of 5772	3820	ComIntRep_X64.exe	140
PID 3820 wrote to memory of 6080	3820	ComIntRep_X64.exe	141
PID 3820 wrote to memory of 2388	3820	ComIntRep_X64.exe	142
PID 3820 wrote to memory of 1184	3820	ComIntRep_X64.exe	143
PID 1184 wrote to memory of 3312	1184	regsvr32.exe	144
PID 3820 wrote to memory of 5972	3820	ComIntRep_X64.exe	145
PID 3820 wrote to memory of 2476	3820	ComIntRep_X64.exe	146
PID 3820 wrote to memory of 4228	3820	ComIntRep_X64.exe	147
PID 3820 wrote to memory of 4288	3820	ComIntRep_X64.exe	148
PID 3820 wrote to memory of 1692	3820	ComIntRep_X64.exe	149
PID 3820 wrote to memory of 2364	3820	ComIntRep_X64.exe	150
PID 3820 wrote to memory of 5240	3820	ComIntRep_X64.exe	151
PID 3820 wrote to memory of 4804	3820	ComIntRep_X64.exe	152
PID 3820 wrote to memory of 2688	3820	ComIntRep_X64.exe	153
PID 3820 wrote to memory of 3244	3820	ComIntRep_X64.exe	154
PID 3820 wrote to memory of 4352	3820	ComIntRep_X64.exe	155
PID 3820 wrote to memory of 6052	3820	ComIntRep_X64.exe	156
PID 3820 wrote to memory of 5028	3820	ComIntRep_X64.exe	157
PID 3820 wrote to memory of 2328	3820	ComIntRep_X64.exe	158
PID 3820 wrote to memory of 5348	3820	ComIntRep_X64.exe	159
PID 3820 wrote to memory of 1252	3820	ComIntRep_X64.exe	160
PID 3820 wrote to memory of 1500	3820	ComIntRep_X64.exe	161
PID 3820 wrote to memory of 1052	3820	ComIntRep_X64.exe	162
PID 3820 wrote to memory of 4944	3820	ComIntRep_X64.exe	163

C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\ComIntRep_X64.exe
"C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\ComIntRep_X64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /all >"C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\Export\IP-202607021809.txt"
  2⤵
  PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ipv4 reset all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\System32\netsh.exe
    netsh interface ipv4 reset all
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ipv6 reset all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\System32\netsh.exe
    netsh interface ipv6 reset all
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh winsock reset catalog
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\System32\netsh.exe
    netsh winsock reset catalog
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh winsock reset
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\System32\netsh.exe
    netsh winsock reset
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /release
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\System32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /renew
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\System32\ipconfig.exe
    ipconfig /renew
    3⤵
    - Gathers network information
    PID:5816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\System32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /registerdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\System32\ipconfig.exe
    ipconfig /registerdns
    3⤵
    - Gathers network information
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh interface ip delete arpcache
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\System32\netsh.exe
    netsh interface ip delete arpcache
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3716
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\custsat.dll"
  2⤵
  PID:4932
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\custsat.dll"
  2⤵
  PID:3140
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\D3DCompiler_47.dll"
  2⤵
  PID:5056
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\D3DCompiler_47.dll"
  2⤵
  PID:1656
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\diagnosticshub.datawarehouse.dll"
  2⤵
  PID:1392
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\diagnosticshub.datawarehouse.dll"
  2⤵
  PID:1496
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\DiagnosticsHub_is.dll"
  2⤵
  PID:2632
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\DiagnosticsHub_is.dll"
  2⤵
  PID:6060
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\DiagnosticsTap.dll"
  2⤵
  PID:752
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\DiagnosticsTap.dll"
  2⤵
  PID:2132
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\F12.dll"
  2⤵
  PID:2772
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\F12.dll"
  2⤵
  PID:1208
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\f12resources.dll"
  2⤵
  PID:5224
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\f12resources.dll"
  2⤵
  PID:2796
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\F12Tools.dll"
  2⤵
  PID:1020
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\F12Tools.dll"
  2⤵
  PID:2892
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\hmmapi.dll"
  2⤵
  PID:2420
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\hmmapi.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Program Files (x86)\internet explorer\hmmapi.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\iedvtool.dll"
  2⤵
  PID:5404
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\iedvtool.dll"
  2⤵
  PID:4476
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\ieproxy.dll"
  2⤵
  PID:5772
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\ieproxy.dll"
  2⤵
  PID:6080
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\IEShims.dll"
  2⤵
  PID:2388
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\IEShims.dll"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Program Files (x86)\internet explorer\IEShims.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3312
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\jsdbgui.dll"
  2⤵
  PID:5972
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\jsdbgui.dll"
  2⤵
  PID:2476
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\jsdebuggeride.dll"
  2⤵
  PID:4228
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\jsdebuggeride.dll"
  2⤵
  PID:4288
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\JSProfilerCore.dll"
  2⤵
  PID:1692
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\JSProfilerCore.dll"
  2⤵
  PID:2364
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\jsprofilerui.dll"
  2⤵
  PID:5240
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\jsprofilerui.dll"
  2⤵
  PID:4804
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\memoryanalyzer.dll"
  2⤵
  PID:2688
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\memoryanalyzer.dll"
  2⤵
  PID:3244
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\msdbg2.dll"
  2⤵
  PID:4352
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\msdbg2.dll"
  2⤵
  PID:6052
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\networkinspection.dll"
  2⤵
  PID:5028
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\networkinspection.dll"
  2⤵
  PID:2328
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\pdm.dll"
  2⤵
  PID:5348
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\pdm.dll"
  2⤵
  PID:1252
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\pdmproxy100.dll"
  2⤵
  PID:1500
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\pdmproxy100.dll"
  2⤵
  PID:1052
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\perf_nt.dll"
  2⤵
  PID:4944
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\perf_nt.dll"
  2⤵
  PID:2624
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\perfcore.dll"
  2⤵
  PID:4972
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\perfcore.dll"
  2⤵
  PID:6056
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\sqmapi.dll"
  2⤵
  PID:5648
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\sqmapi.dll"
  2⤵
  PID:1320
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\timeline.dll"
  2⤵
  - System Time Discovery
  PID:4440
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\timeline.dll"
  2⤵
  - System Time Discovery
  PID:4836
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\internet explorer\Timeline_is.dll"
  2⤵
  - System Time Discovery
  PID:968
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\internet explorer\Timeline_is.dll"
  2⤵
  - System Time Discovery
  PID:3848
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\acelpdec.ax"
  2⤵
  PID:844
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\acelpdec.ax"
  2⤵
  PID:5212
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\actxprxy.dll"
  2⤵
  - Modifies registry class
  PID:1332
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\actxprxy.dll"
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\actxprxy.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1116
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\asctrls.ocx"
  2⤵
  PID:2696
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\asctrls.ocx"
  2⤵
  PID:2996
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\browseui.dll"
  2⤵
  PID:5072
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\browseui.dll"
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\browseui.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5316
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\browseui.dll"
  2⤵
  PID:3264
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\browseui.dll"
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\browseui.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5436
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\browsewm.dll"
  2⤵
  PID:5884
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\browsewm.dll"
  2⤵
  PID:1120
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\cdfview.dll"
  2⤵
  PID:5220
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\cdfview.dll"
  2⤵
  PID:3384
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\comcat.dll"
  2⤵
  PID:4780
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\comcat.dll"
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\comcat.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2484
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\comctl32.dll"
  2⤵
  PID:3056
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\comctl32.dll"
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\comctl32.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5336
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\comctl32.dll"
  2⤵
  PID:6140
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\comctl32.dll"
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\comctl32.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3356
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\system32\comctl32.dll"
  2⤵
  PID:3540
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\SysWoW64\comctl32.dll"
  2⤵
  PID:1712
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i /n "C:\Windows\SysWoW64\comctl32.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5440
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\corpol.dll"
  2⤵
  PID:2672
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\corpol.dll"
  2⤵
  PID:3408
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\CRSWPP.DLL"
  2⤵
  PID:6120
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\CRSWPP.DLL"
  2⤵
  PID:1228
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\CRYPTDLG.DLL"
  2⤵
  - Manipulates Digital Signatures
  PID:3012
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\CRYPTDLG.DLL"
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\CRYPTDLG.DLL"
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    PID:3212
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\cryptdlg.dll"
  2⤵
  PID:5976
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\cryptdlg.dll"
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\cryptdlg.dll"
    3⤵
    PID:1140
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\cryptext.dll"
  2⤵
  PID:1936
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\cryptext.dll"
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\cryptext.dll"
    3⤵
    PID:3640
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\CSSEQCHK.DLL"
  2⤵
  PID:3936
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\CSSEQCHK.DLL"
  2⤵
  PID:4404
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\danim.dll"
  2⤵
  PID:6012
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\danim.dll"
  2⤵
  PID:6092
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\datime.dll"
  2⤵
  PID:568
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\datime.dll"
  2⤵
  PID:4796
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Daxctle.ocx"
  2⤵
  PID:4716
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\Daxctle.ocx"
  2⤵
  PID:2324
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\dhtmled.ocx"
  2⤵
  PID:3180
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\dhtmled.ocx"
  2⤵
  PID:5776
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s "C:\Windows\system32\digest.dll"
  2⤵
  PID:1820
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s "C:\Windows\SysWoW64\digest.dll"
  2⤵
  PID:4432
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\system32\digest.dll"
  2⤵
  PID:616
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\SysWoW64\digest.dll"
  2⤵
  PID:2804
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\directdb.dll"
  2⤵
  PID:4580
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\directdb.dll"
  2⤵
  PID:4156
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\dispex.dll"
  2⤵
  PID:3400
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\dispex.dll"
  2⤵
  PID:6116
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\dispex.dll"
    3⤵
    PID:1904
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\DSSENH.DLL"
  2⤵
  PID:2388
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\DSSENH.DLL"
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\DSSENH.DLL"
    3⤵
    PID:1372
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\dxmasf.dll"
  2⤵
  PID:2824
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\dxmasf.dll"
  2⤵
  PID:5172
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\dxmasf.dll"
    3⤵
    PID:3556
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\dxtmsft.dll"
  2⤵
  PID:2896
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\dxtmsft.dll"
  2⤵
  PID:2152
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\dxtmsft.dll"
    3⤵
    PID:1244
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\dxtrans.dll"
  2⤵
  PID:1448
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\dxtrans.dll"
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\dxtrans.dll"
    3⤵
    PID:5460
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\elshyph.dll"
  2⤵
  PID:5244
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\elshyph.dll"
  2⤵
  PID:4952
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\elshyph.dll"
    3⤵
    PID:4224
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\extmgr.dll"
  2⤵
  PID:2380
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\extmgr.dll"
  2⤵
  PID:3312
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\FLUPL.OCX"
  2⤵
  PID:2328
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\FLUPL.OCX"
  2⤵
  PID:4028
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\FPWPP.DLL"
  2⤵
  PID:4076
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\FPWPP.DLL"
  2⤵
  PID:3876
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\FTPWPP.DLL"
  2⤵
  PID:1088
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\FTPWPP.DLL"
  2⤵
  PID:4732
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Gpkcsp.dll"
  2⤵
  PID:5024
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\Gpkcsp.dll"
  2⤵
  PID:2028
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\hhctrl.ocx"
  2⤵
  PID:1816
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\hhctrl.ocx"
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\hhctrl.ocx"
    3⤵
    PID:2464
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\hlink.dll"
  2⤵
  PID:5724
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\hlink.dll"
  2⤵
  PID:5940
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\hlink.dll"
    3⤵
    PID:3216
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\hmmapi.dll"
  2⤵
  PID:1988
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\hmmapi.dll"
  2⤵
  PID:4068
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\icardie.dll"
  2⤵
  PID:844
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\icardie.dll"
  2⤵
  PID:5212
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\icmfilter.dll"
  2⤵
  PID:4656
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\icmfilter.dll"
  2⤵
  PID:4820
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ieadvpack.dll"
  2⤵
  PID:3580
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ieadvpack.dll"
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\ieadvpack.dll"
    3⤵
    PID:3532
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ieaksie.dll"
  2⤵
  PID:2496
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ieaksie.dll"
  2⤵
  PID:1192
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ieapfltr.dll"
  2⤵
  PID:3980
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ieapfltr.dll"
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\ieapfltr.dll"
    3⤵
    PID:4092
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\iedkcs32.dll"
  2⤵
  PID:2888
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\iedkcs32.dll"
  2⤵
  PID:5640
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\iedkcs32.dll"
    3⤵
    PID:1896
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\iedvtool.dll"
  2⤵
  PID:2484
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\iedvtool.dll"
  2⤵
  PID:4864
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ieetwcollectorres.dll"
  2⤵
  PID:4936
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ieetwcollectorres.dll"
  2⤵
  PID:5300
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ieetwproxystub.dll"
  2⤵
  PID:5016
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ieetwproxystub.dll"
  2⤵
  PID:2428
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\system32\ieframe.dll"
  2⤵
  PID:3428
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\SysWoW64\ieframe.dll"
  2⤵
  PID:244
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i /n "C:\Windows\SysWoW64\ieframe.dll"
    3⤵
    PID:2768
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\iepeers.dll"
  2⤵
  PID:2672
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\iepeers.dll"
  2⤵
  PID:3408
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\iepeers.dll"
    3⤵
    PID:4856
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ieproxy.dll"
  2⤵
  PID:6004
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ieproxy.dll"
  2⤵
  PID:1168
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\ieproxy.dll"
    3⤵
    PID:5056
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\iernonce.dll"
  2⤵
  PID:1396
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\iernonce.dll"
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\iernonce.dll"
    3⤵
    PID:4720
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\iertutil.dll"
  2⤵
  PID:5996
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\iertutil.dll"
  2⤵
  PID:5384
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\iertutil.dll"
    3⤵
    PID:2480
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\iesetup.dll"
  2⤵
  PID:568
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\iesetup.dll"
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\iesetup.dll"
    3⤵
    PID:5860
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\iesysprep.dll"
  2⤵
  PID:5596
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\iesysprep.dll"
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\iesysprep.dll"
    3⤵
    PID:2932
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\system32\ieui.dll"
  2⤵
  PID:5084
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\system32\ieui.dll"
  2⤵
  PID:2852
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ils.dll"
  2⤵
  PID:2568
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ils.dll"
  2⤵
  PID:3068
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\imgutil.dll"
  2⤵
  PID:5796
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\imgutil.dll"
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\imgutil.dll"
    3⤵
    PID:4476
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\inetcfg.dll"
  2⤵
  PID:1700
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\inetcfg.dll"
  2⤵
  PID:2336
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\inetcomm.dll"
  2⤵
  PID:1224
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\inetcomm.dll"
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\inetcomm.dll"
    3⤵
    PID:3728
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\inetcpl.cpl"
  2⤵
  PID:2476
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\inetcpl.cpl"
  2⤵
  PID:5944
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\inetcpl.cpl"
    3⤵
    PID:4228
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\system32\inetcpl.cpl"
  2⤵
  PID:3780
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i /n "C:\Windows\SysWoW64\inetcpl.cpl"
  2⤵
  PID:2364
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i /n "C:\Windows\SysWoW64\inetcpl.cpl"
    3⤵
    PID:1080
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i:A "C:\Windows\system32\initpki.dll"
  2⤵
  PID:3376
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i:A "C:\Windows\SysWoW64\initpki.dll"
  2⤵
  PID:5460
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\inseng.dll"
  2⤵
  PID:1776
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\inseng.dll"
  2⤵
  PID:6128
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\inseng.dll"
    3⤵
    PID:1488
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\javascriptcollectionagent.dll"
  2⤵
  PID:6052
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\javascriptcollectionagent.dll"
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\javascriptcollectionagent.dll"
    3⤵
    PID:5736
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\jscript.dll"
  2⤵
  PID:6104
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\jscript.dll"
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\jscript.dll"
    3⤵
    PID:256
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\jscript9.dll"
  2⤵
  PID:4252
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\jscript9.dll"
  2⤵
  PID:4380
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\jscript9.dll"
    3⤵
    PID:4140
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\jscript9diag.dll"
  2⤵
  PID:2172
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\jscript9diag.dll"
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\jscript9diag.dll"
    3⤵
    PID:5024
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\jsintl.dll"
  2⤵
  PID:2028
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\jsintl.dll"
  2⤵
  PID:4284
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\jsproxy.dll"
  2⤵
  PID:4996
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\jsproxy.dll"
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\jsproxy.dll"
    3⤵
    PID:2304
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\l3codecx.ax"
  2⤵
  PID:3440
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\l3codecx.ax"
  2⤵
  PID:968
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\laprxy.dll"
  2⤵
  PID:1276
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\laprxy.dll"
  2⤵
  PID:816
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\laprxy.dll"
    3⤵
    PID:4568
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\licdll.dll"
  2⤵
  PID:3392
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\licdll.dll"
  2⤵
  PID:1456
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\licmgr10.dll"
  2⤵
  PID:1108
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\licmgr10.dll"
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\licmgr10.dll"
    3⤵
    PID:1940
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\lmrt.dll"
  2⤵
  PID:4400
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\lmrt.dll"
  2⤵
  PID:2496
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\migration\wininetplugin.dll"
  2⤵
  PID:1192
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\migration\wininetplugin.dll"
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\migration\wininetplugin.dll"
    3⤵
    PID:5132
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mlang.dll"
  2⤵
  PID:2968
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mlang.dll"
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\mlang.dll"
    3⤵
    PID:1780
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mmefxe.ocx"
  2⤵
  PID:560
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mmefxe.ocx"
  2⤵
  PID:4780
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mobsync.dll"
  2⤵
  PID:3992
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mobsync.dll"
  2⤵
  PID:1716
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mpg4ds32.ax"
  2⤵
  PID:3448
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mpg4ds32.ax"
  2⤵
  PID:5312
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /SspcCreateSspiReg /s "C:\Windows\system32\msapsspc.dll"
  2⤵
  PID:2596
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /SspcCreateSspiReg /s "C:\Windows\SysWoW64\msapsspc.dll"
  2⤵
  PID:1648
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mscoree.dll"
  2⤵
  PID:1416
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mscoree.dll"
  2⤵
  PID:5396
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\mscoree.dll"
    3⤵
    PID:5340
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mscorier.dll"
  2⤵
  PID:4088
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mscorier.dll"
  2⤵
  PID:4856
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mscories.dll"
  2⤵
  PID:5608
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mscories.dll"
  2⤵
  PID:912
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\mscories.dll"
    3⤵
    PID:6004
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msfeeds.dll"
  2⤵
  PID:2668
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msfeeds.dll"
  2⤵
  PID:1656
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\msfeeds.dll"
    3⤵
    PID:1376
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msfeedsbs.dll"
  2⤵
  PID:3120
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msfeedsbs.dll"
  2⤵
  PID:5380
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\msfeedsbs.dll"
    3⤵
    PID:5004
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mshtmldac.dll"
  2⤵
  PID:2480
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mshtmldac.dll"
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\mshtmldac.dll"
    3⤵
    PID:2512
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msdbg2.dll"
  2⤵
  PID:2772
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msdbg2.dll"
  2⤵
  PID:5960
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msdxm.ocx"
  2⤵
  PID:3180
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msdxm.ocx"
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\msdxm.ocx"
    3⤵
    PID:2560
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mshta.exe"
  2⤵
  PID:1440
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mshta.exe"
  2⤵
  PID:820
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\mshta.exe"
    3⤵
    PID:1504
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mshtml.dll"
  2⤵
  PID:960
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mshtml.dll"
  2⤵
  PID:1036
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\mshtml.dll"
    3⤵
    PID:4436
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\mshtml.dll"
  2⤵
  PID:6096
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\mshtml.dll"
  2⤵
  PID:6080
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\mshtml.dll"
    3⤵
    PID:3208
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mshtmled.dll"
  2⤵
  PID:1004
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mshtmled.dll"
  2⤵
  PID:1372
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\mshtmled.dll"
    3⤵
    PID:2880
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mshtmler.dll"
  2⤵
  PID:5576
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mshtmler.dll"
  2⤵
  PID:4696
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mshtmlmedia.dll"
  2⤵
  PID:2320
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mshtmlmedia.dll"
  2⤵
  PID:5240
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msident.dll"
  2⤵
  PID:1196
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msident.dll"
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\msident.dll"
    3⤵
    PID:4044
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\msieftp.dll"
  2⤵
  PID:4224
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\msieftp.dll"
  2⤵
  PID:900
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\msieftp.dll"
    3⤵
    PID:2208
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msls31.dll"
  2⤵
  PID:5736
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msls31.dll"
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\msls31.dll"
    3⤵
    PID:5348
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /SspcCreateSspiReg /s "C:\Windows\system32\msnsspc.dll"
  2⤵
  PID:2024
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /SspcCreateSspiReg /s "C:\Windows\SysWoW64\msnsspc.dll"
  2⤵
  PID:2332
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msoe.dll"
  2⤵
  PID:5008
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msoe.dll"
  2⤵
  PID:4280
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msoeacct.dll"
  2⤵
  PID:1212
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msoeacct.dll"
  2⤵
  PID:3344
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msr2c.dll"
  2⤵
  PID:2028
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msr2c.dll"
  2⤵
  PID:1260
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msrating.dll"
  2⤵
  PID:2648
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msrating.dll"
  2⤵
  PID:3708
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\msrating.dll"
    3⤵
    PID:2724
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\MSTIME.DLL"
  2⤵
  PID:2148
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\MSTIME.DLL"
  2⤵
  PID:1988
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\mstinit.exe /setup /s"
  2⤵
  PID:3012
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\mstinit.exe /setup /s"
  2⤵
  PID:4068
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\msxml.dll"
  2⤵
  PID:1044
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\msxml.dll"
  2⤵
  PID:3136
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\oeimport.dll"
  2⤵
  PID:5464
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\oeimport.dll"
  2⤵
  PID:4820
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\oemiglib.dll"
  2⤵
  PID:424
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\oemiglib.dll"
  2⤵
  PID:3952
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\ole32.dll"
  2⤵
  PID:3264
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\ole32.dll"
  2⤵
  PID:5436
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\ole32.dll"
    3⤵
    PID:3764
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\oleacc.dll"
  2⤵
  PID:5884
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\oleacc.dll"
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\oleacc.dll"
    3⤵
    PID:3144
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\occache.dll"
  2⤵
  PID:5904
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\occache.dll"
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\occache.dll"
    3⤵
    PID:2740
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\occache.dll"
  2⤵
  PID:5984
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\occache.dll"
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\occache.dll"
    3⤵
    PID:3564
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\oleaut32.dll"
  2⤵
  PID:5336
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\oleaut32.dll"
  2⤵
  PID:5332
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\oleaut32.dll"
    3⤵
    PID:6108
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\plugin.ocx"
  2⤵
  PID:1648
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\plugin.ocx"
  2⤵
  PID:4012
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\pngfilt.dll"
  2⤵
  PID:4496
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\pngfilt.dll"
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\pngfilt.dll"
    3⤵
    PID:1388
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\POSTWPP.DLL"
  2⤵
  PID:1996
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\POSTWPP.DLL"
  2⤵
  PID:3724
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\proctexe.ocx"
  2⤵
  PID:5896
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\proctexe.ocx"
  2⤵
  PID:5728
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\regwizc.dll"
  2⤵
  PID:2668
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\regwizc.dll"
  2⤵
  PID:4872
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\rsabase.dll"
  2⤵
  PID:1732
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\rsabase.dll"
  2⤵
  PID:4236
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\RSAENH.DLL"
  2⤵
  PID:6092
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\RSAENH.DLL"
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\RSAENH.DLL"
    3⤵
    PID:1248
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Sccbase.dll"
  2⤵
  PID:1864
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\Sccbase.dll"
  2⤵
  PID:2436
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\scrobj.dll"
  2⤵
  PID:3816
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\scrobj.dll"
  2⤵
  PID:3180
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\scrobj.dll"
    3⤵
    PID:2560
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\scrrun.dll"
  2⤵
  PID:2820
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\scrrun.dll"
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\scrrun.dll"
    3⤵
    PID:616
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\sendmail.dll"
  2⤵
  PID:2956
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\sendmail.dll"
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\sendmail.dll"
    3⤵
    PID:4476
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\setupwbv.dll"
  2⤵
  PID:2500
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\setupwbv.dll"
  2⤵
  PID:1932
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\setupwbv.dll"
  2⤵
  PID:1224
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\setupwbv.dll"
  2⤵
  PID:5972
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\shdoc401.dll"
  2⤵
  PID:2824
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\shdoc401.dll"
  2⤵
  PID:1324
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\shdoc401.dll"
  2⤵
  PID:2308
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\shdoc401.dll"
  2⤵
  PID:1080
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\shdocvw.dll"
  2⤵
  PID:5928
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\shdocvw.dll"
  2⤵
  PID:3204
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\shdocvw.dll"
    3⤵
    PID:4804
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\shdocvw.dll"
  2⤵
  PID:2688
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\shdocvw.dll"
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\shdocvw.dll"
    3⤵
    PID:5388
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\Slbcsp.dll"
  2⤵
  PID:5108
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\Slbcsp.dll"
  2⤵
  PID:4020
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\softpub.dll"
  2⤵
  PID:6104
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\softpub.dll"
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\softpub.dll"
    3⤵
    PID:1252
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\tdc.ocx"
  2⤵
  PID:1500
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\tdc.ocx"
  2⤵
  PID:2924
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\tdc.ocx"
    3⤵
    PID:6036
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\thumbvw.dll"
  2⤵
  PID:3508
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\thumbvw.dll"
  2⤵
  PID:2624
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\trialoc.dll"
  2⤵
  PID:2988
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\trialoc.dll"
  2⤵
  PID:3676
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\triedit.dll"
  2⤵
  PID:2060
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\triedit.dll"
  2⤵
  PID:4996
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\url.dll"
  2⤵
  PID:3404
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\url.dll"
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\url.dll"
    3⤵
    PID:5256
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\urlmon.dll"
  2⤵
  PID:2564
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\urlmon.dll"
  2⤵
  PID:5212
- - C:\Windows\SysWOW64\regsvr32.exe
    /s /i "C:\Windows\SysWoW64\urlmon.dll"
    3⤵
    PID:4860
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\system32\urlmon.dll,NI,HKLM"
  2⤵
  PID:3952
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s /i "C:\Windows\SysWoW64\urlmon.dll,NI,HKLM"
  2⤵
  PID:2496
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\vbscript.dll"
  2⤵
  PID:1192
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\vbscript.dll"
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\vbscript.dll"
    3⤵
    PID:4056
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\vgx.dll"
  2⤵
  PID:2888
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\vgx.dll"
  2⤵
  PID:3388
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\voxmsdec.ax"
  2⤵
  PID:5816
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\voxmsdec.ax"
  2⤵
  PID:2484
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\wab32.dll"
  2⤵
  PID:4864
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\wab32.dll"
  2⤵
  PID:4936
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\wabfind.dll"
  2⤵
  PID:5512
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\wabfind.dll"
  2⤵
  PID:2596
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\wabimp.dll"
  2⤵
  PID:5852
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\wabimp.dll"
  2⤵
  PID:3428
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s "C:\Windows\system32\webcheck.dll"
  2⤵
  PID:1416
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s "C:\Windows\SysWoW64\webcheck.dll"
  2⤵
  PID:5340
- - C:\Windows\SysWOW64\regsvr32.exe
    /i /s "C:\Windows\SysWoW64\webcheck.dll"
    3⤵
    PID:4088
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\webcheck.dll"
  2⤵
  PID:1832
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\webcheck.dll"
  2⤵
  PID:3548
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\webcheck.dll"
    3⤵
    PID:3716
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\WEBPOST.DLL"
  2⤵
  PID:4988
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\WEBPOST.DLL"
  2⤵
  PID:1936
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\wininet.dll"
  2⤵
  PID:4172
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\wininet.dll"
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\wininet.dll"
    3⤵
    PID:4404
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s "C:\Windows\system32\wininet.dll"
  2⤵
  PID:3120
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s "C:\Windows\SysWoW64\wininet.dll"
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\regsvr32.exe
    /i /s "C:\Windows\SysWoW64\wininet.dll"
    3⤵
    PID:752
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s /n "C:\Windows\system32\wininet.dll"
  2⤵
  PID:2480
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /i /s /n "C:\Windows\SysWoW64\wininet.dll"
  2⤵
  PID:568
- - C:\Windows\SysWOW64\regsvr32.exe
    /i /s /n "C:\Windows\SysWoW64\wininet.dll"
    3⤵
    PID:3484
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\WINTRUST.DLL"
  2⤵
  PID:5224
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\WINTRUST.DLL"
  2⤵
  PID:1248
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\WINTRUST.DLL"
    3⤵
    PID:4084
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\WPWIZDLL.DLL"
  2⤵
  PID:2892
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\WPWIZDLL.DLL"
  2⤵
  PID:4432
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\wshext.dll"
  2⤵
  PID:3332
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\wshext.dll"
  2⤵
  PID:2932
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\wshext.dll"
    3⤵
    PID:460
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\wshom.ocx"
  2⤵
  PID:1464
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\wshom.ocx"
  2⤵
  PID:6096
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Windows\SysWoW64\wshom.ocx"
    3⤵
    PID:2336
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\xmsconf.ocx"
  2⤵
  PID:4700
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Windows\SysWoW64\xmsconf.ocx"
  2⤵
  PID:5476
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\Common Files\microsoft shared\vgx\vgx.dll"
  2⤵
  PID:5508
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\microsoft shared\vgx\vgx.dll"
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Program Files (x86)\Common Files\microsoft shared\vgx\vgx.dll"
    3⤵
    PID:4288
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\Common Files\system\directdb.dll"
  2⤵
  PID:5416
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\system\directdb.dll"
  2⤵
  PID:1928
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\Common Files\system\wab32.dll"
  2⤵
  PID:5240
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Common Files\system\wab32.dll"
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\regsvr32.exe
    /s "C:\Program Files (x86)\Common Files\system\wab32.dll"
    3⤵
    PID:840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop bits
  2⤵
  PID:3296
- - C:\Windows\System32\net.exe
    net stop bits
    3⤵
    PID:1988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop bits
      4⤵
      PID:4232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop wuauserv
  2⤵
  PID:4820
- - C:\Windows\System32\net.exe
    net stop wuauserv
    3⤵
    PID:3432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc sdset bits "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)"
  2⤵
  PID:6136
- - C:\Windows\System32\sc.exe
    sc sdset bits "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)"
    3⤵
    - Launches sc.exe
    PID:5856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004CC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ComIntRep.ini

Path C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\ComIntRep.ini
Size 318B
SHA256 cdb3c3ba28e7190389c832db210bcb0f5093d786dfcd31957e2e7ec818e5fa32
MD5 efb26a5b528f5b9e7a63ecb4c43b6431
SHA1 fd492902a965018afd18e6051cc17bea20e4a6c5
SHA512 bebd99e79294594d57d598fc1459563e484ba438b7367fb0253e2511c8244e7f0f5d44984f0b1938d4f83039ff3e78c5bcae53836e4028dbd81511cd1cc35ca5
TLSH
T101E07D8140A8521C2689C2F74DF1CBD168FC84076C2FAA211427FCC5DE98611B33F1A5
MD5 SHA1 SHA512 TLSH

Submit Download

ComIntRep.log

Path C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\Logging\ComIntRep\ComIntRep.log
Size 3KB
SHA256 63e4279c5aabc0ce9f6bfa35e7abff34f51e0422fdd748fa141995326e8023c7
MD5 82e5faf7b430a379d450be5dfcfbda2d
SHA1 216c9e90ade30e97d1477bdf42f74e4bf55ea642
SHA512 d3f4e4302974320cebe227f5071448daef7dd2f6cc8594144be9ce9e3c0b83bee53b6180cfc488c03b413181a6aad9e80b602cbed388c8579d2b1fa6f49b5129
TLSH
T150712761AE8392DA0324C6850B499607D992070A2287E47A33FED7D00F05F15DBAFDD9
MD5 SHA1 SHA512 TLSH

Submit Download

ComIntRep.log

Path C:\Users\Admin\AppData\Local\Temp\ComIntRep v11.1.3\Logging\ComIntRep\ComIntRep.log
Size 4KB
SHA256 04560e32d4b3319e7aece18a6bef75d161e5695edf9db7a05a8f787e55fed05a
MD5 4147c90300b75afe24a7475de607ed1c
SHA1 eeb3cfc2c41519a63de4de678cc0950f569c7717
SHA512 5b18f9f3df2099615b2c9a0cf96d66b3121615334c928eebd722ac19157753ae91b97af8d164b75772920433c00e82bcca495e7a853d4eef565ca332c23452ee
SSDEEP 96:x5sQ0rztlQeiuflwIJR60iAukeIQ1JOdIJYmJoyYicQJNOpIJUyN2W9IRV:/z0rztae1lwAR60vukeF1EdAYmqyYip6
TLSH
T1C3915B51AE8393DA0324DA840749D60BD991070A2297A47A33FED7D01F01F19DBAFDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RGI6FAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RGI6FAE.tmp
Size 24KB
SHA256 136469b55b9174ce1c71bcbe815bc667925ecfe85f128903433c9d6ffa289a1e
MD5 f6cb11a54a4c0ff683235c9dfc4453c0
SHA1 0ceec83f3b2ee7ace1a9f8119b66ba8ec171952c
SHA512 f78311b41f85a75f0523dc7cd27ff837f982f2c3dea33424a8811fa0aa4c705454fc72d5736fd8da30789f52a11034720586beb4c16f4004e305f0b7b8d08597
SSDEEP 192:D161V1+hcTueeCSh5e29gEK6WK2SpCSPQVsLIn8SYLzoDpjF/qTUqYjZ2l5gnJQT:D12+hcTueeCSXe29KSwIzw3VgYJQT
TLSH
T1F1B2C0295221F7ADB811367D10EF360181DF259AD74CFDD53EC86A507DE9E8380A23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download