floxif | 28d2c0eea0aafe0914f1ec6f3a6257acf81bf35a073ea4e29e0e14ec74651bfa

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	cmd.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Loads dropped DLL 64 IoCs

pid	Process
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4280	vcredist_x86.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
3704	vcredist_x64.exe
616	vcredist_x86.exe
2848	vcredist_x64.exe
2360	VC_redist.x86.exe
3064	vcredist_x64.exe
4660	vcredist_x86.exe
3944	VC_redist.x64.exe
4896	VC_redist.x86.exe
732	vcredist_x64.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
3156	VC_redist.x64.exe
3916	MsiExec.exe
3916	MsiExec.exe
3916	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
4504	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
1860	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe
3928	MsiExec.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20261012002039.log\" /uninstall /passive /norestart ignored ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce"	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20261012002039.log\" /uninstall /passive /norestart ignored ignored ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20261012002039.log\" /uninstall /passive /norestart ignored /burn.runonce"	vcredist_x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce"	vcredist_x86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\dd_vcredist_amd64_0_vcRuntimeMinimum_x64.log	vcredist_x64.exe
File created	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\atl100.dll	msiexec.exe
File created	C:\Windows\system32\mfc100enu.dll	msiexec.exe
File created	C:\Windows\system32\mfcm100u.dll	msiexec.exe
File created	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120rus.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr100.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp100.dll	msiexec.exe
File created	C:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc120jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib120.dll	msiexec.exe
File created	C:\Windows\system32\mfc100ita.dll	msiexec.exe
File created	C:\Windows\system32\msvcp110.dll	msiexec.exe
File created	C:\Windows\system32\mfc110esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File created	C:\Windows\system32\vcomp120.dll	msiexec.exe
File created	C:\Windows\system32\mfc120enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc120rus.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc100fra.dll	msiexec.exe
File created	C:\Windows\system32\vcamp120.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100jpn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm110u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib110.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100fra.dll	msiexec.exe
File opened for modification	\??\c:\Windows\SysWOW64\mfc100deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc110ita.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120cht.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120kor.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc120deu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140jpn.dll	msiexec.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 7 IoCs

execution

Visual Basic

T1059.005

pid	Process
4456	cscript.exe
4472	cscript.exe
1460	cscript.exe
2320	cscript.exe
2256	cscript.exe
1776	cscript.exe
4680	cscript.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4128-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x00090000000244e6-1.dat	upx
behavioral1/memory/4128-15-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4128-538-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4128-1503-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4128-1546-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4128-2308-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\PipelineSegments.store	addinutil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia80.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia90.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\amd64\msdia80.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002233971.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_a53d26c6.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002237393.1\mfc90ita.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100kor_x86	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA776.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120ita_x64	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\KMN8DX2Q7F\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\8BKSEFHF6B\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002144862.1\9.0.30729.7523.policy	msiexec.exe
File created	C:\Windows\assembly\tmp\IEDR6VWN\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\A63Y0V2V\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\3QWTB88U\Microsoft.Office.Tools.Outlook.Implementation.dll	msiexec.exe
File created	C:\Windows\assembly\tmp\68053BB1\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\9BT3TKBLTC\Microsoft.VisualStudio.Tools.Applications.Runtime.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002141550.0\mfcm80.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\44DB0475D85BA123FA0CD6D35465DDC6\12.0.40660\F_CENTRAL_mfc120u_x64	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20261012002234128.0	msiexec.exe
File opened for modification	C:\Windows\Installer\e590d63.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI170A.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20261012002141550.0	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Installer\SourceHash{9BE518E6-ECC6-35A9-88E4-87755C07200F}	msiexec.exe
File created	C:\Windows\Installer\e590d62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6700.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100cht_x64	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002141518.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_76a71f32.cat	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002141690.1\8.0.50727.6229.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002144815.0\atl90.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20261012002234112.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20261012002237393.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9965.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA941.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002144847.0\mfc90jpn.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\e590d01.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE95.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSIB339.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002141690.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\HAW6VB3BDX\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002233971.0\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6229_x-ww_a53d26c6.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002234081.1\8.0.50727.6229.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20261012002234112.0\8.0.50727.6229.policy	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20261012002234081.1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI829F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{53CF6934-A98D-3D84-9146-FC4EDF3D5641}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe
2192	cmd.exe
3336	cmd.exe
5068	cmd.exe
920	cmd.exe
4592	cmd.exe
1744	cmd.exe
1488	cmd.exe
204	cmd.exe
4428	cmd.exe
696	cmd.exe
3688	cmd.exe
4692	cmd.exe
2644	cmd.exe
1056	cmd.exe
4956	cmd.exe
1384	cmd.exe
2408	cmd.exe
4296	cmd.exe
688	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3324	3704	WerFault.exe	173
1512	2360	WerFault.exe	198

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcredist_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c7fddbefb65c088a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c7fddbef0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900c7fddbef000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ac7fddbef000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc7fddbef000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\CLSID = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\CLSID = "{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_X86,V14\DEPENDENTS\{4D8DCF8C-A72A-43E1-9833-C12724DB736E}	VC_redist.x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CE6380BC270BD863282B3D74B09F7570	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0,version="9.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="9.0.30729.7079",culture="neutral" = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c00680056005300540041005f00520075006e00740069006d0065005f0043004c005200330035003e004f005e0051005700690079005b005b007b0039005e004d00310030006300260021005b002a007a0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|AppInfoDocument\|Microsoft.VisualStudio.Tools.Office.AppInfoDocument\|Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll\Microsoft.Vis = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c0068005600530054004f005f00520075006e00740069006d0065005f0043004c005200330035003e007000250054003f00450061004300440074003f007400580062003700520029002c006a002900290000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8520DAD7C5154DD39846DB1714990E7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_x86,v14\Dependents	VC_redist.x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C3AEB2FCAE628F23AAB933F1E743AB79\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v11\DisplayName = "Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61135"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99D651D7-5F7C-470E-8A3B-774D5D9536AC}\ = "VSTOAddinLoader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F09D237B-3FD1-4900-BEF2-3471CA68142D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64654B35-A024-4807-89D3-C6FDB5A260C7}\Control\ = "VSTOFormRegionsHostX"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|AddInSideAdapters\|Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll\Microsoft.VisualStudio.Tools.Office.Excel.Add = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c0068005600530054004f005f00520075006e00740069006d0065005f0043004c005200330035003e00630061004a00780060005100700043002900400067002a0033006d0056006600690047007800720000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\12B8D03ED28D112328CCF0A0D541598E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F\KB2608539 = "Servicing_Key"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\InstanceType = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\44DB0475D85BA123FA0CD6D35465DDC6\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bootstrap.vsto.1\ = "VSTO Deployment Manifest"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E985809A-84A6-4F35-86D6-9B52119AB9D7}\9.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\ProductName = "Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.7523"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\InprocServer32\ = "C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D7840160643A823393312D9347AC55C\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\vstor\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\7ZipSfx.000\\2013\\x64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A4BB3B8BD01A15F4197B6AF4AF3CE17A\AdvertiseFlags = "388"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Office.Tools.Word.Implementation,version="10.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="10.0.60917.0",culture="neutral" = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c0068005600530054004f005f00520075006e00740069006d0065005f0043004c005200340030003e00700065005e005a00290075005200370056003f006f0074002c005b005f0040002a005d0026006e0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9D7840160643A823393312D9347AC55C	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.8.0.Microsoft.VC80.CRT,type="win32-policy",version="8.0.50727.6229",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" = 67006700610044004c004d004e002c00540040003f004400350062002e0057004b0075003d005d00560043005f005200650064006900730074003e0061005a004f002c0048002a004b00320060004500650038004d006b0062004900640046007700550000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\3 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\92091D8AC5E822E408118470F0E997E6\1af2a8da7e60d0b429d7e6453b3d0182	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\ = "{53CF6934-A98D-3D84-9146-FC4EDF3D5641}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.vsto\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99D651D7-5F7C-470E-8A3B-774D5D9536AC}\ = "VSTOAddinLoader"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{61087a79-ac85-455c-934d-1fa22cc64f36}	vcredist_x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{274C2936-A842-45f3-A457-FB4BA4ED1BA2}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9D7840160643A823393312D9347AC55C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode = "D5612BA7437E68D42B4E6384CE5B24D6"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AB297010A1550CA37AFEF0BA14653C28\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}\ = "SmartDocument Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\ProgID\ = "WinForms.Control.Host.V3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.Office.Tools,version="10.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="10.0.60917.0",culture="neutral" = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c0068005600530054004f005f00520075006e00740069006d0065005f0043004c005200340030003e00600035007d00510047006b0069005b004100400033006f0031005d002c00750042004e005600320000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\{CA67548A-5EBE-413A-B50C-4B9CEB6D66C6}	vcredist_x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5040806F8AF9AAC49928419ED5A1D3CA\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F84DEC95EFBEC084A883CF70C9B2CEF0\VC_Runtime_Additional	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C3AEB2FCAE628F23AAB933F1E743AB79	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60DB5E5629367203C8625813703DFCA1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\67D6ECF5CD5FBA732B8B22BAC8DE1B4D\VC_Redist_12222_amd64_enu	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\ProgId\ = "bootstrap.vsto.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{83081C08-382C-4ED4-ACCF-DCBECA021010}\InprocServer32	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\Global\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0,version="9.0.0.0",publicKeyToken="b03f5f7f11d50a3a",processorArchitecture="MSIL",fileVersion="9.0.30729.7079",culture="neutral" = 440048004b00330047007a00760063003800340058006d005b0052005a003100430065004c0068005600530054004f005f00520075006e00740069006d0065005f0043004c005200330035003e00280063003100700070007b005300760045003900460021006900610062002a00460076004800750000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media\7 = ";Microsoft Visual C++ 2005 Redistributable [Disk 1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1af2a8da7e60d0b429d7e6453b3d0182\SourceList\Media\5 = ";Microsoft Visual C++ 2005 Redistributable (x64) [Disk 1]"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F84DEC95EFBEC084A883CF70C9B2CEF0\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EC04D82C-AA59-4ba4-96B1-27BE3FF05E00}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E0D1EC-0A0D-4E50-B8A1-82A8B6ECE5CB}\ = "VSTO SmartTag Action"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.7523",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 5300530073002b005a0066007a00250039003500390027006e006a004d0066002c00350072002700460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e0060004b0053006b004700280068006f002500360077006e004000210048003100530066004400470000000000	msiexec.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

pid	Process
1508	reg.exe
432	reg.exe
2428	reg.exe
3928	reg.exe
4432	reg.exe
2604	reg.exe
3796	reg.exe
560	reg.exe
1116	reg.exe
4800	reg.exe
3328	reg.exe
1860	reg.exe
5048	reg.exe
1524	reg.exe
2868	reg.exe
4172	reg.exe
2328	reg.exe
4536	reg.exe
3400	reg.exe
4864	reg.exe
3820	reg.exe
4136	reg.exe
2540	reg.exe
1792	reg.exe
2008	reg.exe
204	reg.exe
3944	reg.exe
4180	reg.exe
3148	reg.exe
240	reg.exe
732	reg.exe
2836	reg.exe
2388	reg.exe
4440	reg.exe
3612	reg.exe
4900	reg.exe
5080	reg.exe
3172	reg.exe
1116	reg.exe
4856	reg.exe
3792	reg.exe
4716	reg.exe
2352	reg.exe
4568	reg.exe
2704	reg.exe
4928	reg.exe
3612	reg.exe
624	reg.exe
4028	reg.exe
432	reg.exe
4412	reg.exe
2488	reg.exe
2868	reg.exe
1912	reg.exe
404	reg.exe
3992	reg.exe
616	reg.exe
2080	reg.exe
216	reg.exe
4444	reg.exe
3212	reg.exe
2632	reg.exe
4172	reg.exe
3456	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
3492	msiexec.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
3492	msiexec.exe
3492	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
Token: SeIncreaseQuotaPrivilege	3496	WMIC.exe
Token: SeSecurityPrivilege	3496	WMIC.exe
Token: SeTakeOwnershipPrivilege	3496	WMIC.exe
Token: SeLoadDriverPrivilege	3496	WMIC.exe
Token: SeSystemProfilePrivilege	3496	WMIC.exe
Token: SeSystemtimePrivilege	3496	WMIC.exe
Token: SeProfSingleProcessPrivilege	3496	WMIC.exe
Token: SeIncBasePriorityPrivilege	3496	WMIC.exe
Token: SeCreatePagefilePrivilege	3496	WMIC.exe
Token: SeBackupPrivilege	3496	WMIC.exe
Token: SeRestorePrivilege	3496	WMIC.exe
Token: SeShutdownPrivilege	3496	WMIC.exe
Token: SeDebugPrivilege	3496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3496	WMIC.exe
Token: SeRemoteShutdownPrivilege	3496	WMIC.exe
Token: SeUndockPrivilege	3496	WMIC.exe
Token: SeManageVolumePrivilege	3496	WMIC.exe
Token: 33	3496	WMIC.exe
Token: 34	3496	WMIC.exe
Token: 35	3496	WMIC.exe
Token: 36	3496	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3496	WMIC.exe
Token: SeSecurityPrivilege	3496	WMIC.exe
Token: SeTakeOwnershipPrivilege	3496	WMIC.exe
Token: SeLoadDriverPrivilege	3496	WMIC.exe
Token: SeSystemProfilePrivilege	3496	WMIC.exe
Token: SeSystemtimePrivilege	3496	WMIC.exe
Token: SeProfSingleProcessPrivilege	3496	WMIC.exe
Token: SeIncBasePriorityPrivilege	3496	WMIC.exe
Token: SeCreatePagefilePrivilege	3496	WMIC.exe
Token: SeBackupPrivilege	3496	WMIC.exe
Token: SeRestorePrivilege	3496	WMIC.exe
Token: SeShutdownPrivilege	3496	WMIC.exe
Token: SeDebugPrivilege	3496	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3496	WMIC.exe
Token: SeRemoteShutdownPrivilege	3496	WMIC.exe
Token: SeUndockPrivilege	3496	WMIC.exe
Token: SeManageVolumePrivilege	3496	WMIC.exe
Token: 33	3496	WMIC.exe
Token: 34	3496	WMIC.exe
Token: 35	3496	WMIC.exe
Token: 36	3496	WMIC.exe
Token: SeBackupPrivilege	4488	vssvc.exe
Token: SeRestorePrivilege	4488	vssvc.exe
Token: SeAuditPrivilege	4488	vssvc.exe
Token: SeShutdownPrivilege	1640	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	1640	vcredist_x64.exe
Token: SeSecurityPrivilege	3492	msiexec.exe
Token: SeCreateTokenPrivilege	1640	vcredist_x64.exe
Token: SeAssignPrimaryTokenPrivilege	1640	vcredist_x64.exe
Token: SeLockMemoryPrivilege	1640	vcredist_x64.exe
Token: SeIncreaseQuotaPrivilege	1640	vcredist_x64.exe
Token: SeMachineAccountPrivilege	1640	vcredist_x64.exe
Token: SeTcbPrivilege	1640	vcredist_x64.exe
Token: SeSecurityPrivilege	1640	vcredist_x64.exe
Token: SeTakeOwnershipPrivilege	1640	vcredist_x64.exe
Token: SeLoadDriverPrivilege	1640	vcredist_x64.exe
Token: SeSystemProfilePrivilege	1640	vcredist_x64.exe
Token: SeSystemtimePrivilege	1640	vcredist_x64.exe
Token: SeProfSingleProcessPrivilege	1640	vcredist_x64.exe
Token: SeIncBasePriorityPrivilege	1640	vcredist_x64.exe
Token: SeCreatePagefilePrivilege	1640	vcredist_x64.exe
Token: SeCreatePermanentPrivilege	1640	vcredist_x64.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
4280	vcredist_x86.exe
3704	vcredist_x64.exe
616	vcredist_x86.exe
2360	VC_redist.x86.exe
3064	vcredist_x64.exe
4660	vcredist_x86.exe
3944	VC_redist.x64.exe
4896	VC_redist.x86.exe
732	vcredist_x64.exe
4828	msiexec.exe
3156	VC_redist.x64.exe
4828	msiexec.exe
1048	msiexec.exe
1048	msiexec.exe
2356	msiexec.exe
2356	msiexec.exe
4320	msiexec.exe
4320	msiexec.exe
4136	msiexec.exe
4136	msiexec.exe
4180	msiexec.exe
4180	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
4192	msiexec.exe
4192	msiexec.exe
4752	msiexec.exe
4752	msiexec.exe
2952	msiexec.exe
2952	msiexec.exe
2412	msiexec.exe
2412	msiexec.exe
3772	msiexec.exe
3772	msiexec.exe
3556	msiexec.exe
3556	msiexec.exe
548	msiexec.exe
548	msiexec.exe
4940	msiexec.exe
4940	msiexec.exe
4668	msiexec.exe
4668	msiexec.exe
1512	msiexec.exe
1512	msiexec.exe
4712	msiexec.exe
4712	msiexec.exe
3780	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 3336	4128	2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe	96
PID 3336 wrote to memory of 4956	3336	cmd.exe	98
PID 4956 wrote to memory of 4480	4956	cmd.exe	99
PID 3336 wrote to memory of 3924	3336	cmd.exe	100
PID 3336 wrote to memory of 1028	3336	cmd.exe	101
PID 3336 wrote to memory of 5068	3336	cmd.exe	102
PID 3336 wrote to memory of 3608	3336	cmd.exe	103
PID 3336 wrote to memory of 3496	3336	cmd.exe	104
PID 3336 wrote to memory of 3992	3336	cmd.exe	105
PID 3336 wrote to memory of 920	3336	cmd.exe	106
PID 920 wrote to memory of 1048	920	cmd.exe	107
PID 3336 wrote to memory of 4592	3336	cmd.exe	108
PID 4592 wrote to memory of 4340	4592	cmd.exe	109
PID 3336 wrote to memory of 1744	3336	cmd.exe	110
PID 1744 wrote to memory of 4068	1744	cmd.exe	111
PID 3336 wrote to memory of 4044	3336	cmd.exe	112
PID 3336 wrote to memory of 1244	3336	cmd.exe	113
PID 3336 wrote to memory of 1248	3336	cmd.exe	114
PID 3336 wrote to memory of 2168	3336	cmd.exe	115
PID 3336 wrote to memory of 2540	3336	cmd.exe	116
PID 3336 wrote to memory of 4352	3336	cmd.exe	117
PID 3336 wrote to memory of 2068	3336	cmd.exe	118
PID 3336 wrote to memory of 1792	3336	cmd.exe	119
PID 3336 wrote to memory of 4196	3336	cmd.exe	120
PID 3336 wrote to memory of 1208	3336	cmd.exe	121
PID 3336 wrote to memory of 1524	3336	cmd.exe	122
PID 3336 wrote to memory of 4632	3336	cmd.exe	123
PID 3336 wrote to memory of 1772	3336	cmd.exe	124
PID 3336 wrote to memory of 3796	3336	cmd.exe	125
PID 3336 wrote to memory of 4804	3336	cmd.exe	126
PID 3336 wrote to memory of 688	3336	cmd.exe	127
PID 3336 wrote to memory of 2352	3336	cmd.exe	128
PID 3336 wrote to memory of 5108	3336	cmd.exe	129
PID 3336 wrote to memory of 1296	3336	cmd.exe	130
PID 3336 wrote to memory of 4172	3336	cmd.exe	131
PID 3336 wrote to memory of 3004	3336	cmd.exe	132
PID 3336 wrote to memory of 4556	3336	cmd.exe	133
PID 3336 wrote to memory of 1860	3336	cmd.exe	134
PID 3336 wrote to memory of 1508	3336	cmd.exe	135
PID 3336 wrote to memory of 2424	3336	cmd.exe	136
PID 3336 wrote to memory of 3400	3336	cmd.exe	137
PID 3336 wrote to memory of 4952	3336	cmd.exe	138
PID 3336 wrote to memory of 1856	3336	cmd.exe	139
PID 3336 wrote to memory of 4864	3336	cmd.exe	140
PID 3336 wrote to memory of 3976	3336	cmd.exe	141
PID 3336 wrote to memory of 3240	3336	cmd.exe	142
PID 3336 wrote to memory of 404	3336	cmd.exe	143
PID 3336 wrote to memory of 5104	3336	cmd.exe	144
PID 3336 wrote to memory of 4660	3336	cmd.exe	145
PID 3336 wrote to memory of 4028	3336	cmd.exe	146
PID 3336 wrote to memory of 2956	3336	cmd.exe	147
PID 3336 wrote to memory of 2216	3336	cmd.exe	148
PID 3336 wrote to memory of 3928	3336	cmd.exe	149
PID 3336 wrote to memory of 4900	3336	cmd.exe	150
PID 3336 wrote to memory of 1380	3336	cmd.exe	151
PID 3336 wrote to memory of 2008	3336	cmd.exe	152
PID 3336 wrote to memory of 4284	3336	cmd.exe	153
PID 3336 wrote to memory of 1872	3336	cmd.exe	154
PID 3336 wrote to memory of 2488	3336	cmd.exe	155
PID 3336 wrote to memory of 1940	3336	cmd.exe	156
PID 3336 wrote to memory of 216	3336	cmd.exe	157
PID 3336 wrote to memory of 204	3336	cmd.exe	158
PID 3336 wrote to memory of 240	3336	cmd.exe	159
PID 3336 wrote to memory of 1776	3336	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-09_a7fe005c1b7c1f2213a365376c2d7b6a_elex_floxif_wannacry.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Installer.cmd" /auto"
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Windows\system32\reg.exe
      reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3924
- - C:\Windows\system32\findstr.exe
    findstr /c:" 5."
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Windows\system32\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    PID:3608
- - C:\Windows\system32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- - C:\Windows\system32\find.exe
    find /i "ComputerSystem"
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v productname
      4⤵
      PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v UBR
      4⤵
      PID:4340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\reg.exe
      reg query "hklm\software\microsoft\Windows NT\currentversion" /v buildlabex
      4⤵
      PID:4068
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:4044
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:1244
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled
    3⤵
    PID:1248
- - C:\Windows\system32\find.exe
    find /i "0x0"
    3⤵
    PID:2168
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2540
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4352
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2068
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1792
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4196
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1208
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1524
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4632
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1772
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3796
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4804
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:688
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2352
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5108
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1296
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Preview Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4172
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3004
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4556
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 CTP Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1860
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1508
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2424
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3400
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4952
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1856
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4864
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3976
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3240
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 RC Redistributable" /s
    3⤵
    - Modifies registry key
    PID:404
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:5104
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4660
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4028
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2956
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2216
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3928
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4900
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1380
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2008
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4284
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1872
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2019 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:2488
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1940
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:216
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015-2022 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:204
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:240
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:1776
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\wix.txt"
    3⤵
    PID:1764
- - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:436
  - - C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{6883B376-C5E3-4500-B60C-4B87ADA21CF9} {763704F5-E5FB-4897-B6E7-81563198A65D} 436
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:4280
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} /f
    3⤵
    - Modifies registry key
    PID:4568
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
  - - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{13DAE0FA-74D8-45B5-8E7E-A5BB7B53CDB4} {0B20284E-B590-4B70-9A29-7953AF5C89BB} 1640
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:3704
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 1116
        5⤵
        Program crash
        
        PID:3324
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} /f
    3⤵
    - Modifies registry key
    PID:3992
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4408
  - - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
      "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{4335528B-4DA4-453D-931B-6B8E7261F720} {CC6769B1-BC7D-4F1B-9F46-7AD122F54B73} 4408
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:616
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{61087a79-ac85-455c-934d-1fa22cc64f36} /f
    3⤵
    - Modifies registry key
    PID:3944
- - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
  - - C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe
      "C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall /passive /norestart -burn.unelevated BurnPipe.{36671AEC-CD53-4DF9-A93D-04F775C837EF} {E849FC30-C411-47BA-97F2-630FDD085F84} 2516
      4⤵
      Loads dropped DLL
      PID:2848
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} /f
    3⤵
    - Modifies registry key
    PID:5080
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\vc_redist.x86.exe" /uninstall /passive /norestart
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3860
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=528 -burn.filehandle.self=548 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      PID:2360
    - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
        
        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{44FA1F36-1840-4872-BC40-86A0E3633836} {A5A493D7-EA17-42DF-A508-136190D14320} 2360
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 956
        5⤵
        Program crash
        
        PID:1512
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{4d8dcf8c-a72a-43e1-9833-c12724db736e} /f
    3⤵
    - Modifies registry key
    PID:616
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\vc_redist.x64.exe" /uninstall /passive /norestart
    3⤵
    PID:3116
  - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=548 /uninstall /passive /norestart
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3944
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E8A28ED5-BF8E-44C1-9FAE-414E19A69986} {F13F9AF5-5C7C-4D43-915E-609D93D1608F} 3944
        5⤵
        Adds Run key to start application
        
        PID:2036
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} /f
    3⤵
    - Modifies registry key
    PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1488
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp100.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - Executes a command shell one-liner
    PID:4296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
    3⤵
    - Executes a command shell one-liner
    PID:1384
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp110.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.61135.400
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
    3⤵
    - Executes a command shell one-liner
    PID:2644
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp120.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1056
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\SysWOW64\msvcp140.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 40.33810.0
    3⤵
    - Executes a command shell one-liner
    PID:2192
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3456
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3004
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:452
- - C:\Windows\system32\findstr.exe
    findstr /i /v {710f4c1c-cc18-4c49-8cbf-51240c89a1a2}
    3⤵
    PID:3064
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3172
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4060
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2836
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4900
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4632
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:3540
- - C:\Windows\system32\findstr.exe
    findstr /i /v {9BE518E6-ECC6-35A9-88E4-87755C07200F}
    3⤵
    PID:4856
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    PID:1900
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1444
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:3792
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4352
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:412
- - C:\Windows\system32\findstr.exe
    findstr /i /v {F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}
    3⤵
    PID:4132
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x86 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4716
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2100
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4792
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2868
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:204
- - C:\Windows\system32\findstr.exe
    findstr /i /v {B175520C-86A2-35A7-8619-86DC379688B9}
    3⤵
    PID:240
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4172
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2408
- - C:\Windows\system32\findstr.exe
    findstr /i /v {BD95A8CD-1D9F-35AD-981A-3E7925026EBB}
    3⤵
    PID:1428
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3612
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3804
- - C:\Windows\system32\findstr.exe
    findstr /i /v {D401961D-3A20-3AC7-943B-6139D5BD490A}
    3⤵
    PID:5104
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4440
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4180
- - C:\Windows\system32\findstr.exe
    findstr /i /v {8122DAB1-ED4D-3676-BB0A-CA368196543E}
    3⤵
    PID:4952
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2328
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4196
- - C:\Windows\system32\findstr.exe
    findstr /i /v {5EA6C998-D5AC-4ED9-89C3-9F25B17CCD3D}
    3⤵
    PID:5008
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:2704
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1116
- - C:\Windows\system32\findstr.exe
    findstr /i /v {0C3457A0-3DCE-4A33-BEF0-9B528C557771}
    3⤵
    PID:4344
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:560
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1408
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x86 Minimum Runtime" /s
    3⤵
    PID:2124
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4268
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:5048
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4444
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4536
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1208
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3820
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1788
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:432
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1568
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:4412
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3608
- - C:\Windows\system32\reg.exe
    reg query hklm\software\wow6432node\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x86 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:216
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1764
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:3004
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{9BE518E6-ECC6-35A9-88E4-87755C07200F} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4828
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{9BE518E6-ECC6-35A9-88E4-87755C07200F} /f
    3⤵
    - Modifies registry key
    PID:1116
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:1048
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\wow6432node\microsoft\windows\currentversion\uninstall\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5} /f
    3⤵
    - Modifies registry key
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
    3⤵
    - Executes a command shell one-liner
    PID:204
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.60917.0
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
    3⤵
    - Executes a command shell one-liner
    PID:688
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp100.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40219.473
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp120.dll"
    3⤵
    - Executes a command shell one-liner
    PID:696
  - - C:\Windows\system32\cscript.exe
      cscript.exe //nologo filever.vbs "C:\Windows\System32\msvcp120.dll"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c echo 0.40664.0
    3⤵
    - Executes a command shell one-liner
    PID:3688
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:732
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3804
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:5104
- - C:\Windows\system32\findstr.exe
    findstr /i /v {ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}
    3⤵
    PID:3612
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2005 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4180
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4952
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4884
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    PID:1572
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4452
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:2472
- - C:\Windows\system32\findstr.exe
    findstr /i /v {5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}
    3⤵
    PID:3064
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2008 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:1116
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3284
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4728
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4444
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2560
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4456
- - C:\Windows\system32\findstr.exe
    findstr /i /v {1D8E6291-B0D5-35EC-8441-6616F567A0F7}
    3⤵
    PID:5028
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2010 x64 Redistributable" /s
    3⤵
    - Modifies registry key
    PID:4800
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3820
- - C:\Windows\system32\findstr.exe
    findstr /r "{.*-.*-.*-.*-.*}"
    3⤵
    PID:4320
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:624
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1500
- - C:\Windows\system32\findstr.exe
    findstr /i /v {37B8F9C7-03FB-3253-8781-2517C99D7C00}
    3⤵
    PID:1460
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2012 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1912
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:3780
- - C:\Windows\system32\findstr.exe
    findstr /i /v {CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}
    3⤵
    PID:1016
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2836
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4632
- - C:\Windows\system32\findstr.exe
    findstr /i /v {010792BA-551A-3AC0-A7EF-0FAB4156C382}
    3⤵
    PID:4900
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2013 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4856
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1900
- - C:\Windows\system32\findstr.exe
    findstr /i /v {53CF6934-A98D-3D84-9146-FC4EDF3D5641}
    3⤵
    PID:2032
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3212
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4192
- - C:\Windows\system32\findstr.exe
    findstr /i /v {59CED48F-EBFE-480C-8A38-FC079C2BEC0F}
    3⤵
    PID:4132
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2022 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:3148
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4668
- - C:\Windows\system32\findstr.exe
    findstr /i /v {B8B3BB4A-A10D-4F51-91B7-A64FFAC31EA7}
    3⤵
    PID:3120
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2604
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4808
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 14 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4928
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4680
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:3328
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:4344
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2015 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:240
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2072
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2632
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:816
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2017 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:4136
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2412
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Additional Runtime" /s
    3⤵
    - Modifies registry key
    PID:2388
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:2256
- - C:\Windows\system32\reg.exe
    reg query hklm\software\microsoft\windows\currentversion\uninstall /f "Microsoft Visual C++ 2019 x64 Minimum Runtime" /s
    3⤵
    - Modifies registry key
    PID:1508
- - C:\Windows\system32\find.exe
    find /i "HKEY_LOCAL_MACHINE"
    3⤵
    PID:1228
- - C:\Windows\system32\findstr.exe
    findstr /i "HKEY_LOCAL_MACHINE" "C:\Users\Admin\AppData\Local\Temp\msi.txt"
    3⤵
    PID:4512
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2356
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4} /f
    3⤵
    - Modifies registry key
    PID:432
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /passive /norestart
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4320
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7} /f
    3⤵
    - Modifies registry key
    PID:2428
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{5740BD44-B58D-321A-AFC0-6D3D4556DD6C} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4136
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C} /f
    3⤵
    - Modifies registry key
    PID:3612
- - C:\Windows\system32\msiexec.exe
    MsiExec.exe /X{CB0836EC-B072-368D-82B2-D3470BF95707} /passive /norestart
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:4180
- - C:\Windows\system32\reg.exe
    reg delete hklm\software\microsoft\windows\currentversion\uninstall\{CB0836EC-B072-368D-82B2-D3470BF95707} /f
    3⤵
    - Modifies registry key
    PID:4432
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x64\vcredist.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3924
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x64\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4192
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x64\vc_red.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4752
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2952
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2012\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:2412
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3772
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2013\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - Suspicious use of FindShellTrayWindow
    PID:3556
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeMinimum_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:548
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2022\x64\vc_runtimeAdditional_x64.msi" /qb
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4940
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\vstor\vstor40_x64.msi" /qb
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:4668
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2005\x86\vcredist.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1512
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2008\x86\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4712
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2010\x86\vc_red.msi" /qb
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3780

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1524

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 6335FDB830F9C9E6B546361467CEA6D1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3916
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 6F1D80A6DB5642EA694C3A5F526C8476
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4504
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 363680666ADF9F49BCD0E3E04E2DDC90
  2⤵
  - Loads dropped DLL
  PID:1860
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding C4730AB91A112CF975B5E644A9389573
  2⤵
  - Loads dropped DLL
  PID:3928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 89974F5C230039A992C8F4E070CC22A2
  2⤵
  PID:3300
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CAD44DF19B073CA4386310063B7606BF
  2⤵
  PID:4452
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A752C829F7460DC75247A5DB94A39280
  2⤵
  PID:4924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76B298087E4DD7630B690DEDB8048709
  2⤵
  PID:4552
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 56CBD8DE110FBA0AB8191EFD6316DEB0
  2⤵
  PID:4120
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3C935A45D66653ED907F2B848ADAEEBD M Global\MSI0000
  2⤵
  PID:4776
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1B5F695433FA6A168C8D9CAF8DDE4511 E Global\MSI0000
  2⤵
  PID:4132
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    - Drops file in Program Files directory
    PID:4400
- - C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:4952
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3384
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F386D54207625F5A289E75DEEBB30E9B E Global\MSI0000
  2⤵
  PID:2192
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4412
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1440
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1156
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4800
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4472
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:4744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3660
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4216
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2320
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3064
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2408
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2596
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3508
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4856
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5032
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:60
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1248
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1872
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2840
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1284
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2320
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4432
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3820
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1884
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:5068
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1740
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:4672
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:3212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1188
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2488
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3300
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4724
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2444
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:940
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4432
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3804
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1160
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:404
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1884
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5068
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3868
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:3948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1564
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4632
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2448
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4352
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:3384
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:416
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4080
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4412
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1116
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:1408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2532
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:2584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3804
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1512
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependencies
    3⤵
    PID:4500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:1804
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:4472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 211C64E15E678E0B9ECF0F73DA94071B
  2⤵
  PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3704 -ip 3704
1⤵
PID:2008

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002039.log" /uninstall /passive /norestart ignored /burn.runonce
1⤵
PID:4420
- C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002039.log /uninstall /passive /norestart ignored
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4720
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002039.log /uninstall /passive /norestart ignored -burn.unelevated BurnPipe.{4DA422D1-58E3-41B4-B19E-0A2266F69F04} {D359DE71-650D-41F9-A6A3-7037122D24EA} 4720
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3064

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /burn.runonce
1⤵
PID:2916
- C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
  "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261012002042.log"
  2⤵
  - Adds Run key to start application
  PID:2640
- - C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
    "C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261012002042.log" -burn.unelevated BurnPipe.{8D10E7EB-F5ED-487D-AA55-D2015A77AC1A} {81F5005F-48DF-4CD4-BB52-0458C138AE3D} 2640
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4660

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /burn.runonce
1⤵
PID:1012
- C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261012002047.log"
  2⤵
  PID:5108
- - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=556 -burn.filehandle.self=516 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20261012002047.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4896
  - - C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{472AD8CA-C534-4F8C-A43B-ACD4033429AF} {922084A2-A958-4B69-A6A1-69E44D9A5F5D} 4896
      4⤵
      Adds Run key to start application
      PID:3120

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002039.log" /uninstall /passive /norestart ignored ignored /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:3700
- C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
  "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002039.log /uninstall /passive /norestart ignored ignored
  2⤵
  - Adds Run key to start application
  PID:208
- - C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
    "C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /burn.log.append C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002039.log /uninstall /passive /norestart ignored ignored -burn.unelevated BurnPipe.{BF041F86-1228-43F4-8969-493D19FB01C8} {D7734195-2F52-42CC-A352-C63C0DAA8570} 208
    3⤵
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2360 -ip 2360
1⤵
PID:4668

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
PID:3048
- C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002054.log"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1232
- - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=648 /passive /uninstall /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012002054.log"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery