573d4f8505e61c19238ed89188ec3054769f8875d0ab6a83b23ff2a00661b9fe

Analysis

max time kernel
1163s
max time network
992s
platform
windows7_x64
resource
win7-en
submitted
09-09-2021 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Proof Of Payment.docx
Size

55KB
MD5

ea71d89968b7905ee75c44dcae8230c2
SHA1

616c670c9bc92a00da095818a8d12982ea80c705
SHA256

573d4f8505e61c19238ed89188ec3054769f8875d0ab6a83b23ff2a00661b9fe
SHA512

fcd58a1198317042f21599222d237fbe8547080032f29c9b70c38f6f8779dbf6be3e37462a867803fb6cd2059a643cd3a357cb2ceba2efaaf4589a0a58d4b7d7

Score

10^/10

adware persistence stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 388 EQNEDT32.EXE
Executes dropped EXE 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1340 EQNEDT32.EXE
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

flow	pid	process
7	388	EQNEDT32.EXE

pid	process
1340	EQNEDT32.EXE

Loads dropped DLL 64 IoCs

Processes:

Setup.exeMsiExec.exemsiexec.exeMsiExec.exe

pid	process
1752	Setup.exe
1752	Setup.exe
1964	MsiExec.exe
1964	MsiExec.exe
1964	MsiExec.exe
1964	MsiExec.exe
1964	MsiExec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1964	MsiExec.exe
1964	MsiExec.exe
572	MsiExec.exe
572	MsiExec.exe
572	MsiExec.exe
572	MsiExec.exe
572	MsiExec.exe
572	MsiExec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeSetup.exeWINWORD.EXE

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	Setup.exe
File opened (read-only)	\??\K:	WINWORD.EXE
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	Setup.exe
File opened (read-only)	\??\B:	WINWORD.EXE
File opened (read-only)	\??\Z:	WINWORD.EXE
File opened (read-only)	\??\F:	Setup.exe
File opened (read-only)	\??\H:	Setup.exe
File opened (read-only)	\??\Q:	Setup.exe
File opened (read-only)	\??\S:	Setup.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	WINWORD.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	Setup.exe
File opened (read-only)	\??\T:	WINWORD.EXE
File opened (read-only)	\??\P:	WINWORD.EXE
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	Setup.exe
File opened (read-only)	\??\U:	Setup.exe
File opened (read-only)	\??\J:	WINWORD.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	Setup.exe
File opened (read-only)	\??\Q:	WINWORD.EXE
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	Setup.exe
File opened (read-only)	\??\Y:	Setup.exe
File opened (read-only)	\??\N:	WINWORD.EXE
File opened (read-only)	\??\G:	Setup.exe
File opened (read-only)	\??\M:	Setup.exe
File opened (read-only)	\??\X:	Setup.exe
File opened (read-only)	\??\H:	WINWORD.EXE
File opened (read-only)	\??\S:	WINWORD.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	WINWORD.EXE
File opened (read-only)	\??\L:	WINWORD.EXE
File opened (read-only)	\??\O:	WINWORD.EXE
File opened (read-only)	\??\Z:	Setup.exe
File opened (read-only)	\??\A:	WINWORD.EXE
File opened (read-only)	\??\F:	WINWORD.EXE
File opened (read-only)	\??\U:	WINWORD.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	Setup.exe
File opened (read-only)	\??\Y:	WINWORD.EXE
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	Setup.exe
File opened (read-only)	\??\M:	WINWORD.EXE
File opened (read-only)	\??\R:	WINWORD.EXE
File opened (read-only)	\??\V:	WINWORD.EXE
File opened (read-only)	\??\W:	WINWORD.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	Setup.exe
File opened (read-only)	\??\P:	Setup.exe
File opened (read-only)	\??\R:	Setup.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Drops file in System32 directory 2 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\FM20ENU.DLL msiexec.exe
File created C:\Windows\SysWOW64\FM20ENU.DLL msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\FM20ENU.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\FM20ENU.DLL	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\FOLDER.ICO	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_INIT.XSN	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Init.xsn	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL.IDX_DLL	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1031\hxdsui.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EAWFINTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Portal\1033\PortalConnect.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10O.CHM	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Review.xsn	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Sign.xsn	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\Xlate_Init.xsn	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1036\hxdsui.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1049\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\xlsrvintl.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Sign.xsn	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\+Connect to New Data Source.odc	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.REST.IDX_DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1033\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OFFOWCI.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1036\hxdsui.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\FOLDER.ICO	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\BCSRuntimeRes.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EntityPickerIntl.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1041\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1046\hxdsui.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL.IDX_DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\README.HTM	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI6341.tmp	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210909044945730.0	msiexec.exe
File opened for modification	C:\Windows\Installer\f7529df.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE448.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f752a00.ipi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210909044945746.1	msiexec.exe
File opened for modification	C:\Windows\Installer\f7529e5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI26C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI897A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FFB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC85A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E25.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB31.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210909044945746.1\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D42.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI559F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8009.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C88.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f752992.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210909044945730.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d7860533.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\f7529ba.ipi	msiexec.exe
File created	C:\Windows\Installer\f7529dc.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI157.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F3F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9882.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7529b8.mst	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210909044945730.1\mfc90deu.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF433.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7529f7.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5560.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5B98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC7E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA27B.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210909044945777.0\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\Installer\f7529e5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID74B.tmp	msiexec.exe
File created	C:\Windows\Installer\f7529fa.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7FC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID709.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C82.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5398.tmp	msiexec.exe
File created	C:\Windows\Installer\f7529a7.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8959.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI49D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4713.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC29F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D9.tmp	msiexec.exe

Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 3 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXEEQNEDT32.EXEEQNEDT32.EXE

pid process

1308 EQNEDT32.EXE
1340 EQNEDT32.EXE
388 EQNEDT32.EXE

pid	process
1308	EQNEDT32.EXE
1340	EQNEDT32.EXE
388	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\45	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\46	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\49	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\44	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\41	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\45	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\4B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\47	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\48	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\82848AD8CDE5AC14BBD070AF839C537A\1033\BRANDING.XML = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b0041006c00770061007900730049006e007300740061006c006c006500640049006e0074006c005f0031003000330033003c000000780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b005300650074007500700043006f006e00740072006f006c006c0065007200460069006c00650073003e0040005b005d005f002c006a004b005200210039005900640026004e00700079002d0037005500310000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\1388E932434EA1242A73205BAD92D9CE\Excel\1033 = 780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b0045005800430045004c00460069006c006500730049006e0074006c005f0031003000330033003e0025004700340071004d0050002c004f004500390028004900280048004f0064006a004500470029007300650074006c0061006e0067000000780062002700420056004d002800380041002400210021002100210021004d004b004b0053006b0045007800630065006c0043006f006e007600650072007400650072003100320049006e0074006c005f0031003000330033003e0025004700340071004d0050002c004f004500390028004900280048004f0064006a004500470029007300650074006c0061006e00670000007800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0045007800630065006c0043006f006e007600650072007400650072003100320049006e0074006c005f0031003000330033003e0025004700340071004d0050002c004f004500390028004900280048004f0064006a004500470029007300650074006c0061006e00670000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppam\ShellEx\PropertyHandler	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\10BE92CC2CB71D119A12000A9CE1A22A\eps = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b0047007200610070006800690063007300460069006c007400650072007300450050005300460069006c006500730049006e0074006c005f0031003000330033003c0045006e00630061007000730075006c006100740065006400200050006f00730074005300630072006900700074005c0030005c0031005c0065007000730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Equations\NotInsertable	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\urbanlet.dot = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e004800250066006d0078003d00740051003f003900710032002b004a002b004500590051005b004f005b005e00340032005d005c0055007200620061006e0020004c00650074007400650072002e0064006f007400780000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/zip	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002CE02-0000-0000-C000-000000000046}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\ShellEx\PropertyHandler	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A\3082 = 780062002700420056005e007d00740072002600210021002100210021004d004b004b0053006b00460069006e00640041006c006c0057006f007200640046006f0072006d007300460069006c00650073005f0033003000380032003c0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\1388E932434EA1242A73205BAD92D9CE\List\1033 = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b004100430043004500530053004e006f006e0042006f006f007400460069006c006500730049006e0074006c005f0031003000330033003e004b005a00720052007a00660034006e0042003900210048005a003100530057006a005b002d0038007300650074006c0061006e0067000000780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b0045005800430045004c004e006f006e0042006f006f007400460069006c006500730049006e0074006c005f0031003000330033003e004b005a00720052007a00660034006e0042003900210048005a003100530057006a005b002d0038007300650074006c0061006e0067000000780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b004c00490053005400460069006c006500730049006e0074006c005f0031003000330033003e004b005a00720052007a00660034006e0042003900210048005a003100530057006a005b002d0038007300650074006c0061006e00670000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\Fax\orielfax.dotx = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e00600068005a0063003600640055002b0040003900670038006900710027003800780067006d0047005b005e00320046005d005c004f007200690065006c0020004600610078002e0064006f007400780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\C18DD6C0F9032D11A9A90006794C4E25\1033 = 780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b004f00750074006c006f006f006b004400560045007800740065006e00730069006f006e007300460069006c006500730049006e0074006c005f0031003000330033003e002d004b00290065006f006d0065002a004f003f0071006a005e00730039004800720054003900400000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\odccube.1\HTML Handler\shell\edit	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F5BF6FE9-913F-4117-94C7-5040C7E3A6C1}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsm\PersistentHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LR.LexRefStArObject.1.0\ = "LexRefStArObject Class"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\C1B9F03778BFB9F44A7480D07DBA8673\1036 = 7800620027004200560057003f00570041002400210021002100210021004d004b004b0053006b00540068006500730061007500720075007300460069006c00650073005f0031003000330036003e005f0032003500380078005e0058003200740039005e007a0060004800400077002e0077004b002e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\EssentialLetter.dotx = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e0071004f0029005f002600300074007e005b0040007d002900260071004f007a005800560032006a005b005e00340032005d005c0045007300730065006e007400690061006c0020004c00650074007400650072002e0064006f007400780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{B9BEFFFD-2160-48AB-B029-B8F00228688E},1033 = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e000000780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e000000780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e000000780062002700420056004d002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0041006c00770061007900730049006e007300740061006c006c006500640000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{918BBA59-8B9C-4854-BC9D-0C8FAF56F872},1033 = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057004f0052004400460069006c006500730000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109A20000000100000000F01FEC\Project64Files	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{B9BEFFFD-2160-48AB-B029-B8F00228688E},1033 = 780062002700420056004d002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0041006c00770061007900730049006e007300740061006c006c00650064000000780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e000000780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e0000007800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{CC29EB61-7BC2-11D1-A921-00A0C91E2AA2},1033\mail.oft = 780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c004f00750074006c006f006f006b00540065006d0070006c00610074006500460069006c006500730000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{AD722A80-AD66-4974-A4D6-034C37CE8BB7},1033\WINWORD.DEV.HXS = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057004f0052004400480065006c007000460069006c006500730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\odcdatabase.1\HTML Handler\shell\edit	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsm\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109A20090400100000000F01FEC\SetupControllerFiles	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109610090400000000000F01FEC\SetupXmlFiles	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\4DCB319E06591D11781C00AA007AE1D2\1033\JudgesCh.htm = 780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b004f00750074006c006f006f006b00530074006100740069006f006e0065007200790045007800740065006e0064006500640049006e0074006c005f0031003000330033003c004d006100720062006c006500640020004400650073006b002e00680074006d0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{E913BCD6-9560-11D1-87C1-00AA00A71E2D},1033\notebook.jpg = 780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c004f00750074006c006f006f006b00530074006100740069006f006e0065007200790042006100730069006300460069006c006500730000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{4EAD0498-4F35-4FF3-A6A6-3AE68392BA5E},1033 = 780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e000000780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e0000007800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\Tabs_Part.accdt = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00410063006300650073007300540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e007000340062002d006400410047006600260040004400650041007b00450064004a006600410067005b005e0030005d005c0054006100620073005f0050006100720074002e006100630063006400740000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.oasis.opendocument.spreadsheet	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\odcfile\ShellEx\IconHandler	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\F100B59B52C47924CBFBA19EC5849DE5\nlg_updates\3082 = 780062002700420056005e007d00740072002600210021002100210021004d004b004b0053006b005300700065006c006c0069006e00670041006e0064004700720061006d006d0061007200460069006c00650073005f0033003000380032003e005a00400058004d006d006d0078002e003d0039007d004c0024002600510049006f0063006600560000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{AD722A80-AD66-4974-A4D6-034C37CE8BB7},1033\vbhw6.chm = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00410063006300650073007300480065006c007000460069006c00650073000000780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00560042004100480065006c007000460069006c006500730000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dotx\ShellEx\PropertyHandler\ = "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\URLRedirection.URLRedirectionBHO\CLSID\ = "{B4F3A835-0E21-4959-BA22-42B3008E02FF}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{1E77DE88-BCAB-4C37-B9E5-073AF52DFD7A},Csi.dll.x64 = 7800620027004200560052002100210021002100340021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00500072006f006400750063007400460069006c006500730000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\odctable.1\HTML Handler\shell\edit\command	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{39462CCF-449B-11DE-913E-00161726FD05},x86\1033\bhointl.dll = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00500072006f006400750063007400460069006c006500730000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\MedRepor.dot = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e005e00700078004f00440064003800610026003d0042002800240055002d0039006e006900320065005b005e00360041005d005c004d0065006400690061006e0020005200650070006f00720074002e0064006f007400780000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ODCCUBEFILE\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\A7E1D8E54471016489E87D8511DB7834	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\F4BE92CC2CB71D119A12000A9CE1A22A	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109611090400100000000F01FEC\Gimme_OnDemandData	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\7EE0D72DE8492D11B8E3000CF497E92C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\PersistentHandler	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\08A227DA66DA47944A6D30C473ECB87B\1033\vbhw6.chm = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00560042004100480065006c007000460069006c006500730049006e0074006c005f0031003000330033003e004200330042007d004500540055006c006600280045004c0064007100460067006b0057005f0042000000780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00410063006300650073007300480065006c007000460069006c006500730049006e0074006c005f0031003000330033003e004200330042007d004500540055006c006600280045004c0064007100460067006b0057005f00420000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\90D36D095E6F36F4EA2170800E47A4B7\3082 = 780062002700420056005e007d00740072002600210021002100210021004d004b004b0053006b00480079007000680065006e006100740069006f006e00460069006c00650073005f0033003000380032003e0065006000530024007800590031004f003f003900270051006100400041005300710042005400460000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F5BF6FE9-913F-4117-94C7-5040C7E3A6C1}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BCSLaunch.Launcher\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}\ = "{5A98B233-3C59-4B31-944C-0E560D85E6C3}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\odcfile	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{AD722A80-AD66-4974-A4D6-034C37CE8BB7},1033\vbendf98.chm = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00560042004100480065006c007000460069006c00650073000000780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00410063006300650073007300480065006c007000460069006c006500730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.ppsx\ShellEx\PropertyHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Equation.2\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109511090400000000000F01FEC\SetupControllerFiles	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\AB40BCA4AA5E38B489F32F8E785C977D	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1992 WINWORD.EXE

pid	process
1992	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msiexec.exe

pid	process
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe
1688	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Setup.exe

pid process

1752 Setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeDrvInst.exeSetup.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	892	vssvc.exe
Token: SeRestorePrivilege	892	vssvc.exe
Token: SeAuditPrivilege	892	vssvc.exe
Token: SeRestorePrivilege	1680	DrvInst.exe
Token: SeRestorePrivilege	1680	DrvInst.exe
Token: SeRestorePrivilege	1680	DrvInst.exe
Token: SeRestorePrivilege	1680	DrvInst.exe
Token: SeRestorePrivilege	1680	DrvInst.exe
Token: SeRestorePrivilege	1680	DrvInst.exe
Token: SeRestorePrivilege	1680	DrvInst.exe
Token: SeLoadDriverPrivilege	1680	DrvInst.exe
Token: SeLoadDriverPrivilege	1680	DrvInst.exe
Token: SeLoadDriverPrivilege	1680	DrvInst.exe
Token: SeShutdownPrivilege	1752	Setup.exe
Token: SeIncreaseQuotaPrivilege	1752	Setup.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeSecurityPrivilege	1688	msiexec.exe
Token: SeCreateTokenPrivilege	1752	Setup.exe
Token: SeAssignPrimaryTokenPrivilege	1752	Setup.exe
Token: SeLockMemoryPrivilege	1752	Setup.exe
Token: SeIncreaseQuotaPrivilege	1752	Setup.exe
Token: SeMachineAccountPrivilege	1752	Setup.exe
Token: SeTcbPrivilege	1752	Setup.exe
Token: SeSecurityPrivilege	1752	Setup.exe
Token: SeTakeOwnershipPrivilege	1752	Setup.exe
Token: SeLoadDriverPrivilege	1752	Setup.exe
Token: SeSystemProfilePrivilege	1752	Setup.exe
Token: SeSystemtimePrivilege	1752	Setup.exe
Token: SeProfSingleProcessPrivilege	1752	Setup.exe
Token: SeIncBasePriorityPrivilege	1752	Setup.exe
Token: SeCreatePagefilePrivilege	1752	Setup.exe
Token: SeCreatePermanentPrivilege	1752	Setup.exe
Token: SeBackupPrivilege	1752	Setup.exe
Token: SeRestorePrivilege	1752	Setup.exe
Token: SeShutdownPrivilege	1752	Setup.exe
Token: SeDebugPrivilege	1752	Setup.exe
Token: SeAuditPrivilege	1752	Setup.exe
Token: SeSystemEnvironmentPrivilege	1752	Setup.exe
Token: SeChangeNotifyPrivilege	1752	Setup.exe
Token: SeRemoteShutdownPrivilege	1752	Setup.exe
Token: SeUndockPrivilege	1752	Setup.exe
Token: SeSyncAgentPrivilege	1752	Setup.exe
Token: SeEnableDelegationPrivilege	1752	Setup.exe
Token: SeManageVolumePrivilege	1752	Setup.exe
Token: SeImpersonatePrivilege	1752	Setup.exe
Token: SeCreateGlobalPrivilege	1752	Setup.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1992 WINWORD.EXE
1992 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

1992 WINWORD.EXE
1992 WINWORD.EXE
1992 WINWORD.EXE
1992 WINWORD.EXE

pid	process
1992	WINWORD.EXE
1992	WINWORD.EXE

pid	process
1992	WINWORD.EXE
1992	WINWORD.EXE
1992	WINWORD.EXE
1992	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WINWORD.EXEmsiexec.exe

description	pid	process	target process
PID 1992 wrote to memory of 1020	1992	WINWORD.EXE	splwow64.exe
PID 1992 wrote to memory of 1020	1992	WINWORD.EXE	splwow64.exe
PID 1992 wrote to memory of 1020	1992	WINWORD.EXE	splwow64.exe
PID 1992 wrote to memory of 1020	1992	WINWORD.EXE	splwow64.exe
PID 1688 wrote to memory of 1964	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1964	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1964	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1964	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1964	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1964	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1964	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 572	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 572	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 572	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 572	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 572	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 572	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 572	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1636	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1636	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1636	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1636	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1636	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1636	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1636	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1976	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1976	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1976	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1976	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1976	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1976	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1976	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1944	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1944	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1944	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1944	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1944	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1944	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1944	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 2024	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 2024	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 2024	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 2024	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 2024	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 2024	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 2024	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1320	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1320	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1320	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1320	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1320	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1320	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1320	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1400	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1400	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1400	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1400	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1400	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1400	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 1400	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 388	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 388	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 388	1688	msiexec.exe	MsiExec.exe
PID 1688 wrote to memory of 388	1688	msiexec.exe	MsiExec.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Proof Of Payment.docx"
1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1020

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Launches Equation Editor
PID:388

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
PID:1308

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot10" "" "" "699077f33" "0000000000000000" "00000000000005DC" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F35E1C8991B2D4B65747B2C0BAC949DC
2⤵
- Loads dropped DLL
PID:1964

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A35F9FDE4E25D01B5E15A75C63DF8431 M Global\MSI0000
2⤵
- Loads dropped DLL
PID:572

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AD4E3418DBB65942FC03E1FC0E854D75
2⤵
PID:1636

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 99FC271BE871C7F9900981860A4306C2
2⤵
PID:1976

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3373A3C3121253151280DBCD6EB496E1 M Global\MSI0000
2⤵
PID:1944

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C7ABDCF10F71512754DE17A42AC02081
2⤵
PID:2024

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CC3929D22242960076A400904655B713 M Global\MSI0000
2⤵
PID:1320

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B127850F8724A5F38DBB9A8154DD51A5
2⤵
PID:1400

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9B8D3C03D9E9BF3230803138A18A9D7D M Global\MSI0000
2⤵
PID:388

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ADCE120C0E183CFCC5C1D00B178EF673
2⤵
PID:748

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 75813BD70EA8F48688C41C94FECF1129 M Global\MSI0000
2⤵
PID:1776

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0E84113CE65B163F4E3DCC42C3A124A8
2⤵
PID:1396

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 070A742A6452AEB694B4156A93912363
2⤵
PID:1836

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DFDCCF2E1B16BD190BE91E1F1A9CD1B4
2⤵
PID:288

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9D3CB5D5CE56A2F481A0E378035DD0AB
2⤵
PID:2016

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7A0F48AA1B6CEB8F500BE1064365E3C4
2⤵
PID:1396

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding ED69DF2EEF72B12355603AB84B0D2B63
2⤵
PID:516

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A74BB9364D052891D9A52C74D97F8791
2⤵
PID:1588

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 14AEFC788F5065D902D0787A3AB7C5E9 M Global\MSI0000
2⤵
PID:1968

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 904D9A8DFE1DBA0ABFF877291F27A102
2⤵
PID:1804

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6F79353315AED6C1AA6A818C19F4EF97 M Global\MSI0000
2⤵
PID:1256

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 774984633DD758CF8F269598FA52F535
2⤵
PID:1668

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1CC611E471CCF3759A60D222F3C45BE5 M Global\MSI0000
2⤵
PID:1336

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DDA93BC446034A8695C3CFE56DA64AAD
2⤵
PID:1776

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7B00A45F71E289B189BE0F0359A00D06
2⤵
PID:1536

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0F8785CC29FB3C5951B0814AC9B79E3C M Global\MSI0000
2⤵
PID:1608

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 03D5F87DED6554493F00E10515124898
2⤵
PID:1804

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 45202F29AE0E87CA94DB4A6CA02DC5AA M Global\MSI0000
2⤵
PID:1972

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2496367B226B871EC07CBF4EECCDD567
2⤵
PID:1508

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 34B7421E58C61E2515B293D88E99FC27
2⤵
PID:1336

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9C79AFDA10DDA36E09D5605D72096B45
2⤵
PID:1572

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 009F7763C79515105F394D7C7951561F M Global\MSI0000
2⤵
PID:1976

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E678D8E8E248AC0C6B24871E831E44D1
2⤵
PID:1368

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F25355486B83563C86517D8D9E759C98 M Global\MSI0000
2⤵
PID:944

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 120D468E161AB653AE772BA430EADA98
2⤵
PID:1636

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0F0F0584C4C56095D413B4CFA54AD672
2⤵
PID:1936

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F664C4A658D8D31EEA2D5DF1E7740530 M Global\MSI0000
2⤵
PID:1240

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 18422F3D1D6F98139CF53824CBEDD64A
2⤵
PID:748

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E12A3B27DB2D8E1F2B21E07B15866381 M Global\MSI0000
2⤵
PID:1284

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 0C439E5E250D9FCFA314AFBF47544213
2⤵
PID:1288

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 14932211ED2EBDF66FDD4C48E48048D4 M Global\MSI0000
2⤵
PID:1580

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 10D27D1E427A87E374FB7D6D3E7281BF
2⤵
PID:1748

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 84BD3CD75D26D48ED94B06213DBAAC47
2⤵
PID:812

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F612F0C7F589D2B61213888053064CB1
2⤵
PID:1700

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9C246110B9B2F99882A411683F3E092F
2⤵
PID:1272

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D89AD336A7BD7223F347B4926A034378
2⤵
PID:1636

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 51C9A6559341D532BC8D83F098C75D4B
2⤵
PID:1704

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 33452E3EBDC80A76E0AF44BDB8417213
2⤵
PID:1508

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 84A1146D8031196A3ED24CBF0C8F0394 M Global\MSI0000
2⤵
PID:1380

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E83FD446D46CF03D3B9515B4F92937D6
2⤵
PID:944

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 42A04315068564439593399D4FA716F9 M Global\MSI0000
2⤵
PID:1740

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AAA2B518103000C1491FCF5ED2FBBA36
2⤵
PID:1240

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 63E081F666218CA8AF9E972B32ACA2B8 M Global\MSI0000
2⤵
PID:840

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 84DB338DCC95B9EB473578F518B054F4
2⤵
PID:1288

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D3723F1EEB9CF7CD09A011A6D384F666 M Global\MSI0000
2⤵
PID:1976

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A5126602D2EAFB31D897A02528F8108C
2⤵
PID:1536

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9FABAABDF345AFBC00F2F68AB5B4A985
2⤵
PID:1832

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 618BC8F190C86BB74DDF42200E8DBEB4 M Global\MSI0000
2⤵
PID:1276

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A4981CBCC4B14BE70777C220C099E320
2⤵
PID:1056

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A90979A49B13A933A8A58FFCB1289E83 M Global\MSI0000
2⤵
PID:1508

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Executes dropped EXE
- Launches Equation Editor
PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\MSI26C2.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSI280B.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSI2EE0.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
C:\Windows\Installer\MSI30F4.tmp
MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSI3133.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
C:\Windows\Installer\MSI33D3.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
C:\Windows\Installer\MSI3431.tmp
MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSI34EF.tmp
MD5
b8255a1bc3c307557741d2c99b8256d1

SHA1
48cc6f3c1a566f06684c5184cf830cbd7db638c2

SHA256
796aea9a46fb7704222a7fe1f4e27455b14640c816d6f961344f89dc47537b33

SHA512
85f685ad84f2208ad87ff34fb5e99edae50fc938a9335cb9747b7707d237c1b397c318090112eee0e9f04777ee004e26e7377f57c3e31159a96638b65110a69c

Download Submit
\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL
MD5
f3e1265f2f72f0f30464c19fc0d9263d

SHA1
a63a10d4b34916cfc0d1b9d990244710b25b4b0f

SHA256
092167fb8180160d65ab2f79cc9fba22ef91580af15be7bcddb27ac5613f34dd

SHA512
b5b4c86ec9b107d9bf501fe4597394d0eec5c0ea08135a38cbfd583e56662e311033ebfd5bab312e51f4fb3d2733d3d40b482a1af1ed1d855c067bafd1476b88

Download Submit
\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL
MD5
f3e1265f2f72f0f30464c19fc0d9263d

SHA1
a63a10d4b34916cfc0d1b9d990244710b25b4b0f

SHA256
092167fb8180160d65ab2f79cc9fba22ef91580af15be7bcddb27ac5613f34dd

SHA512
b5b4c86ec9b107d9bf501fe4597394d0eec5c0ea08135a38cbfd583e56662e311033ebfd5bab312e51f4fb3d2733d3d40b482a1af1ed1d855c067bafd1476b88

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll
MD5
e4d4a3de0c14a9f671bd51bf1ae3871c

SHA1
9cf4eb26d5738278bac70d67d4116553bd6bae4b

SHA256
4f0bfc8d0c92768ac3b06b777bbd0546d40ea84ededc165f36e6e95289643379

SHA512
ecd6463924d2802b7185e44b98ec555f70c6b061bbeaed27c6dce7432df48ed6e16721db47452b101ac9c533e9518c25c4a1beeacd14442ab85987f7fab01fdf

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll
MD5
e4d4a3de0c14a9f671bd51bf1ae3871c

SHA1
9cf4eb26d5738278bac70d67d4116553bd6bae4b

SHA256
4f0bfc8d0c92768ac3b06b777bbd0546d40ea84ededc165f36e6e95289643379

SHA512
ecd6463924d2802b7185e44b98ec555f70c6b061bbeaed27c6dce7432df48ed6e16721db47452b101ac9c533e9518c25c4a1beeacd14442ab85987f7fab01fdf

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll
MD5
90b238e111675742ca28f75681d61661

SHA1
6b3201576b54e68bdcef6fe86a0a5a476546447b

SHA256
87d3e4fb8f0023c8dfb6c3fa1d5589b51887f2a06ef9d87ee7efc470c571072b

SHA512
f99add04f9528347f5ee2612194595d2512c7a9e2d37c9b99251a72680c652a0c1733176cb70abc29e06988e455a278a1bc50b71f4e17a20a4afd8ddd2bcacfa

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll
MD5
90b238e111675742ca28f75681d61661

SHA1
6b3201576b54e68bdcef6fe86a0a5a476546447b

SHA256
87d3e4fb8f0023c8dfb6c3fa1d5589b51887f2a06ef9d87ee7efc470c571072b

SHA512
f99add04f9528347f5ee2612194595d2512c7a9e2d37c9b99251a72680c652a0c1733176cb70abc29e06988e455a278a1bc50b71f4e17a20a4afd8ddd2bcacfa

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll
MD5
e51ccbe599c54365f60a653f00fb6b59

SHA1
dae0f5d259e090029f00b20ae6e92b2f30f418a9

SHA256
856681f9d3dc69ea52a252355497ec89d8e31260801edb4da387f65037bac91a

SHA512
8aad801ea7bea8383ca90b2188ddefb616361b58388dcd2307301101ad7b7268395d516bb517a06784701292c96bf2b359d94abb02618072b6a8fdee23356999

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll
MD5
e51ccbe599c54365f60a653f00fb6b59

SHA1
dae0f5d259e090029f00b20ae6e92b2f30f418a9

SHA256
856681f9d3dc69ea52a252355497ec89d8e31260801edb4da387f65037bac91a

SHA512
8aad801ea7bea8383ca90b2188ddefb616361b58388dcd2307301101ad7b7268395d516bb517a06784701292c96bf2b359d94abb02618072b6a8fdee23356999

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll
MD5
7d26561d455c8a8e209d680b0d9bc6aa

SHA1
262b41f9d8d44fce5dd4f350dae520b986dff51d

SHA256
0d0925e02b163157fb1686e9ad0a2b6ccc70399f87efd6f1235d360415a3030a

SHA512
abda368f0613b3cc1f16aedddf5796cd53b1c3494fbaa6a2a3ab5d119175e4faf7bcfda9aeaa94dadcc7f7ced8a0ce3fe3964d4ae93b6a79f54b39ddcb10b285

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll
MD5
7d26561d455c8a8e209d680b0d9bc6aa

SHA1
262b41f9d8d44fce5dd4f350dae520b986dff51d

SHA256
0d0925e02b163157fb1686e9ad0a2b6ccc70399f87efd6f1235d360415a3030a

SHA512
abda368f0613b3cc1f16aedddf5796cd53b1c3494fbaa6a2a3ab5d119175e4faf7bcfda9aeaa94dadcc7f7ced8a0ce3fe3964d4ae93b6a79f54b39ddcb10b285

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll
MD5
85d90766b76a5036d29a0d98c1dae439

SHA1
d4d1631c834156be8c451400b014d45c9b8df188

SHA256
b5d4f362ac5e9a3090a2f8f17028e769d39cd3cac535375124701a3699203fc6

SHA512
8875523b25f122a9fe9c644b42275ef1e0a37c6621dcf81ec1382f99d8042ab282c67fd2a03486c6b8c2432ee55374bdba85602445011b50ccf055d6b7a4de81

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll
MD5
85d90766b76a5036d29a0d98c1dae439

SHA1
d4d1631c834156be8c451400b014d45c9b8df188

SHA256
b5d4f362ac5e9a3090a2f8f17028e769d39cd3cac535375124701a3699203fc6

SHA512
8875523b25f122a9fe9c644b42275ef1e0a37c6621dcf81ec1382f99d8042ab282c67fd2a03486c6b8c2432ee55374bdba85602445011b50ccf055d6b7a4de81

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll
MD5
53ecaf0ed506967df2a045b75ed52e24

SHA1
8d9d80ba0b959e39a51c6f98c790bc15b7e1a661

SHA256
08ff8c6aee190de31a999ca7adf0c9f84105388059abe98b8338c0b86c079f21

SHA512
e467633564be38935dd2154a9408bd79789e920dcffa46dd5a9eaab3dd5c4f883dac79c3a0b90224f82ee124db00b5e18b052203011ee9ba2193c814cc5ddf59

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll
MD5
53ecaf0ed506967df2a045b75ed52e24

SHA1
8d9d80ba0b959e39a51c6f98c790bc15b7e1a661

SHA256
08ff8c6aee190de31a999ca7adf0c9f84105388059abe98b8338c0b86c079f21

SHA512
e467633564be38935dd2154a9408bd79789e920dcffa46dd5a9eaab3dd5c4f883dac79c3a0b90224f82ee124db00b5e18b052203011ee9ba2193c814cc5ddf59

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll
MD5
8cec568e66cab7a5cf8a14d850fbb002

SHA1
289790c09d5ff4b5ab879945fa33f1ec679b2299

SHA256
3b5c2165335de6286809371b6e1ae8f4c0d3b3da5e9b3ac0ff56e9c49572df60

SHA512
f3c4b7a4d02052c962a46c91a176fead0d52619422658f45b0e3e710e98070b7a14ad0f1804b7e12b789c26fb1df25356668212e30102a3e6d570d7cbe170c2b

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll
MD5
8cec568e66cab7a5cf8a14d850fbb002

SHA1
289790c09d5ff4b5ab879945fa33f1ec679b2299

SHA256
3b5c2165335de6286809371b6e1ae8f4c0d3b3da5e9b3ac0ff56e9c49572df60

SHA512
f3c4b7a4d02052c962a46c91a176fead0d52619422658f45b0e3e710e98070b7a14ad0f1804b7e12b789c26fb1df25356668212e30102a3e6d570d7cbe170c2b

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll
MD5
44eb9257752e952193faf408bf3abc57

SHA1
58bc265c8ef47d41fa50a83c347a035ef2aa2bd0

SHA256
136e3b1202b60425376d7214450e33d7daaaeb6c44a13e457875ab6a3680b179

SHA512
21a7d2cb785fcd3cfda5596f10906f4cf86ad83f43480db7d2e13e3b9068d48956f8afbdaab136dd755424dac5b214d2fbd61616c402cce3c6510c167250c13a

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll
MD5
44eb9257752e952193faf408bf3abc57

SHA1
58bc265c8ef47d41fa50a83c347a035ef2aa2bd0

SHA256
136e3b1202b60425376d7214450e33d7daaaeb6c44a13e457875ab6a3680b179

SHA512
21a7d2cb785fcd3cfda5596f10906f4cf86ad83f43480db7d2e13e3b9068d48956f8afbdaab136dd755424dac5b214d2fbd61616c402cce3c6510c167250c13a

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll
MD5
74b19a2653267fdeaa6c6d3ddf3a0a9a

SHA1
7db8df8d30f83dda8dce9b00a44e183c81f02427

SHA256
ca8356bad057117751142f489ce26937fc47f564700071638371e5e49c5746a4

SHA512
0453798ee131cc2bd46ea02a683541e2d46c9d81231e4d95c1d7192e5e691c639277828b2726dd76f9caeffb2a7941db9e7d47a4b4c03abb329ce3a57e6170ab

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll
MD5
74b19a2653267fdeaa6c6d3ddf3a0a9a

SHA1
7db8df8d30f83dda8dce9b00a44e183c81f02427

SHA256
ca8356bad057117751142f489ce26937fc47f564700071638371e5e49c5746a4

SHA512
0453798ee131cc2bd46ea02a683541e2d46c9d81231e4d95c1d7192e5e691c639277828b2726dd76f9caeffb2a7941db9e7d47a4b4c03abb329ce3a57e6170ab

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll
MD5
8bd9dd8f8fc5a876ce73159ad63d77f4

SHA1
78e8d2720f4a12f6699a6ac421ba32c5d15e427a

SHA256
ce6707b76876170c8609644599117da8853d14e8c46acedaf145b2f7aa9f7590

SHA512
9a0049994315ec9d0ee66b2f3e33c9cb1472b18aee95e4c5072f64c7aef40d2c87ff69529a373a78ff1be5ded5504ae3d1200df8b81ee148fcfffa44ddfc737c

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll
MD5
8bd9dd8f8fc5a876ce73159ad63d77f4

SHA1
78e8d2720f4a12f6699a6ac421ba32c5d15e427a

SHA256
ce6707b76876170c8609644599117da8853d14e8c46acedaf145b2f7aa9f7590

SHA512
9a0049994315ec9d0ee66b2f3e33c9cb1472b18aee95e4c5072f64c7aef40d2c87ff69529a373a78ff1be5ded5504ae3d1200df8b81ee148fcfffa44ddfc737c

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll
MD5
b0421e0fc013d4b57dba92f4ac2fda04

SHA1
0a6ef388b6570f384b1a1fce16ccb9731a0484bc

SHA256
2b31902a74bcd0247764a1fcc40514b8adf5a2dd881a7b07148d8e74339458ca

SHA512
d7ce694350bb7f6543d4b650c4fefc1236914d2226b5c5ac1aae5e9b4d9dab7e0ae16e1e8f326128ec270c97a7d9f297960b03fb1e91565acd087a32153a3880

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll
MD5
b0421e0fc013d4b57dba92f4ac2fda04

SHA1
0a6ef388b6570f384b1a1fce16ccb9731a0484bc

SHA256
2b31902a74bcd0247764a1fcc40514b8adf5a2dd881a7b07148d8e74339458ca

SHA512
d7ce694350bb7f6543d4b650c4fefc1236914d2226b5c5ac1aae5e9b4d9dab7e0ae16e1e8f326128ec270c97a7d9f297960b03fb1e91565acd087a32153a3880

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL
MD5
0f45ff4af4c58c9391fca2d83a227877

SHA1
39c22315e9588b4da0cc4aba40131df4b58f0c65

SHA256
6b10a06fe12810d77cd4acaac9b016672cabd31b49d9497f71d418d0ba699049

SHA512
050781f003c6c51b7924f95c5e14ef64459f6915bc3efe96ac62d75ea23c36d988a8ed5cf59829ffedb9334e7771efac2859403ba8f2c7a6ad1c3a60349ddf9d

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL
MD5
0f45ff4af4c58c9391fca2d83a227877

SHA1
39c22315e9588b4da0cc4aba40131df4b58f0c65

SHA256
6b10a06fe12810d77cd4acaac9b016672cabd31b49d9497f71d418d0ba699049

SHA512
050781f003c6c51b7924f95c5e14ef64459f6915bc3efe96ac62d75ea23c36d988a8ed5cf59829ffedb9334e7771efac2859403ba8f2c7a6ad1c3a60349ddf9d

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll
MD5
8dc70c718cfe61c8017c0dbc43343e92

SHA1
de644e1f049124083f6cca9e6ac2f37cbdceb936

SHA256
7be147891e8b70b2a217f57e9242e669a352c0adfc8798cfef6c9d8f3e478d89

SHA512
a73a781f127721ca4b9a6f10dc712acb4a5248974301c36f88923dbda6f1309f45dae506bfca8d93be196ea97db3c82c16ca5f356b3677aa98eb45c9dcf2cfb6

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll
MD5
8dc70c718cfe61c8017c0dbc43343e92

SHA1
de644e1f049124083f6cca9e6ac2f37cbdceb936

SHA256
7be147891e8b70b2a217f57e9242e669a352c0adfc8798cfef6c9d8f3e478d89

SHA512
a73a781f127721ca4b9a6f10dc712acb4a5248974301c36f88923dbda6f1309f45dae506bfca8d93be196ea97db3c82c16ca5f356b3677aa98eb45c9dcf2cfb6

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL
MD5
bbf8782c834372d50599272e1761abf4

SHA1
e6abbae824fbf6c3db00bcc709d725e48f0911ba

SHA256
4cc94dd1764ad4b6eada16b98c4f108b7be0fd622cee573b91ca9ea8cc5829bb

SHA512
3a94b4dbe0628220a3b1bbdacec6d2fb7f47d8533bcca24415dc3c0ef330a44937cf93a4c83127ab1486926c76039ffad86372c2deab8cb94f2d1ccf6f45f042

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL
MD5
bbf8782c834372d50599272e1761abf4

SHA1
e6abbae824fbf6c3db00bcc709d725e48f0911ba

SHA256
4cc94dd1764ad4b6eada16b98c4f108b7be0fd622cee573b91ca9ea8cc5829bb

SHA512
3a94b4dbe0628220a3b1bbdacec6d2fb7f47d8533bcca24415dc3c0ef330a44937cf93a4c83127ab1486926c76039ffad86372c2deab8cb94f2d1ccf6f45f042

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BCSRuntimeRes.dll
MD5
489e68a40665d8b9189e9914ed652860

SHA1
a098d84098ec2d270e9648aecf52ece6b214d810

SHA256
71aa309ca25ae19e306584ecd272649d4971e2f909acbb619159fd138e383f8b

SHA512
51cec82e9c2fd01b363bffcd6b6178920fba657532e1ba3c11e6dd233cf7c76923a0246fe43fd3675b03877af4267d540708400f7c69792203b6b242c5638d74

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BCSRuntimeRes.dll
MD5
489e68a40665d8b9189e9914ed652860

SHA1
a098d84098ec2d270e9648aecf52ece6b214d810

SHA256
71aa309ca25ae19e306584ecd272649d4971e2f909acbb619159fd138e383f8b

SHA512
51cec82e9c2fd01b363bffcd6b6178920fba657532e1ba3c11e6dd233cf7c76923a0246fe43fd3675b03877af4267d540708400f7c69792203b6b242c5638d74

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL
MD5
6e81fc49020455eec05de61d3a75b89d

SHA1
a5a082362cfae8f1127f88e3b25647b766dd34af

SHA256
9eb326a4338cc9e8e1c7af79db0f51b44e95aa0733372f623a6b9d36dcb15fe3

SHA512
bca5011ae15b42445f79baed7752c09d04ec276f4a7c78ba07e9ff0e3dec8070e270c51801cf02e77e339d045dbb7efb71eb7063da95011ea3e3e942587bb4eb

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL
MD5
6e81fc49020455eec05de61d3a75b89d

SHA1
a5a082362cfae8f1127f88e3b25647b766dd34af

SHA256
9eb326a4338cc9e8e1c7af79db0f51b44e95aa0733372f623a6b9d36dcb15fe3

SHA512
bca5011ae15b42445f79baed7752c09d04ec276f4a7c78ba07e9ff0e3dec8070e270c51801cf02e77e339d045dbb7efb71eb7063da95011ea3e3e942587bb4eb

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EAWFINTL.DLL
MD5
e9018bb84192a96a99677a715b638013

SHA1
eaf2079894af4cc93411d9eb01cb7095b8859278

SHA256
fe26756547e4a52c4eeda3f3b29528052c157a93ea1f8c6254679be3152f777b

SHA512
f3a7b59caaab4ad0608bc8538ef79352033cdc561ca4384eacdd6b879db430c0e2388cb6b7e06736cd8727f7e50c7bc91919304fcf053f96ee8206be7ffe5949

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EAWFINTL.DLL
MD5
e9018bb84192a96a99677a715b638013

SHA1
eaf2079894af4cc93411d9eb01cb7095b8859278

SHA256
fe26756547e4a52c4eeda3f3b29528052c157a93ea1f8c6254679be3152f777b

SHA512
f3a7b59caaab4ad0608bc8538ef79352033cdc561ca4384eacdd6b879db430c0e2388cb6b7e06736cd8727f7e50c7bc91919304fcf053f96ee8206be7ffe5949

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EntityPickerIntl.dll
MD5
b46debbb3b0a16492a76ec167ddfd349

SHA1
af588fb0fcd67f604c7af62cf378b9d0c5634621

SHA256
8c3643813ce0b4b882616f38273f0459bb5712d8cf16e837deaf90eeb9d09d1b

SHA512
6ce4571eebc01d0ddb35468c0299be348f18942bf318a569af24b0a4f9907e48220d3ec76216e2f9c664c5b19dad03ce89794f5f799e5e84472d18e7197fea4a

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EntityPickerIntl.dll
MD5
b46debbb3b0a16492a76ec167ddfd349

SHA1
af588fb0fcd67f604c7af62cf378b9d0c5634621

SHA256
8c3643813ce0b4b882616f38273f0459bb5712d8cf16e837deaf90eeb9d09d1b

SHA512
6ce4571eebc01d0ddb35468c0299be348f18942bf318a569af24b0a4f9907e48220d3ec76216e2f9c664c5b19dad03ce89794f5f799e5e84472d18e7197fea4a

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\OFFOWCI.DLL
MD5
7f97c66e925f9fa7a6fb5e56cc2c003a

SHA1
cd875f7029a055dec68066654250a12c4e7bec86

SHA256
53aacdca9f61559a5e2147dc5ea941683fb6d195378f682864c3a06bf0aa1fb6

SHA512
9003d7a07ce56352e7792d442924f29f58269f872173413e4f03c77e4f9a9b6b059337bf7ae5008ea4600c083476046970e8cd036b6939cf5a914872b90bbd20

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\OFFOWCI.DLL
MD5
7f97c66e925f9fa7a6fb5e56cc2c003a

SHA1
cd875f7029a055dec68066654250a12c4e7bec86

SHA256
53aacdca9f61559a5e2147dc5ea941683fb6d195378f682864c3a06bf0aa1fb6

SHA512
9003d7a07ce56352e7792d442924f29f58269f872173413e4f03c77e4f9a9b6b059337bf7ae5008ea4600c083476046970e8cd036b6939cf5a914872b90bbd20

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\1036\ENVELOPR.DLL.trx_dll
MD5
10fa6ecb335d75b17d2c3ac4f3cbaabb

SHA1
0f549eed3c20f7178f2b6f12cb8f3c0dcf022f94

SHA256
1dd89f6d6d5159abd258bf7c0126382986781bee81ad7f7da15e50f2db8e45b8

SHA512
c55f5986fb3ba8d2828d0428a8599cfc1e2b1db7263ffc4bedcc016a3ba47539534685b3dfa0edaff5a8e90a7272cac113cedb3ae672cb43a8a6c42040c1ac01

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\1036\ENVELOPR.DLL.trx_dll
MD5
10fa6ecb335d75b17d2c3ac4f3cbaabb

SHA1
0f549eed3c20f7178f2b6f12cb8f3c0dcf022f94

SHA256
1dd89f6d6d5159abd258bf7c0126382986781bee81ad7f7da15e50f2db8e45b8

SHA512
c55f5986fb3ba8d2828d0428a8599cfc1e2b1db7263ffc4bedcc016a3ba47539534685b3dfa0edaff5a8e90a7272cac113cedb3ae672cb43a8a6c42040c1ac01

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\3082\ENVELOPR.DLL.trx_dll
MD5
d9cec19cdbe418dc49759eddf7572a2e

SHA1
96b165af2f03dbd70825997321f4e0fd1d20a6d8

SHA256
0d3c16cbd05a5cd725e44f5053f69bf1901260eee7ae306a376dc87f2b452509

SHA512
dcf6ea16210e723875dea2e6526399a61398c34bc60f35dbc7eed3ae27c7f6a9c3d8ce55dde24bf4105c8298d9f25fddfb511dce5b5add0dd347817e038c6e00

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\3082\ENVELOPR.DLL.trx_dll
MD5
d9cec19cdbe418dc49759eddf7572a2e

SHA1
96b165af2f03dbd70825997321f4e0fd1d20a6d8

SHA256
0d3c16cbd05a5cd725e44f5053f69bf1901260eee7ae306a376dc87f2b452509

SHA512
dcf6ea16210e723875dea2e6526399a61398c34bc60f35dbc7eed3ae27c7f6a9c3d8ce55dde24bf4105c8298d9f25fddfb511dce5b5add0dd347817e038c6e00

Download Submit
\Users\Admin\AppData\Local\Temp\Setup000006d8\OSETUP.DLL
MD5
fcc38158c5d62a39e1ba79a29d532240

SHA1
eca2d1e91c634bc8a4381239eb05f30803636c24

SHA256
e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74

SHA512
0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7

Download Submit
\Users\Admin\AppData\Local\Temp\Setup000006d8\OSETUPUI.DLL
MD5
196a884e700b7eb09b2cd0a48eccbc3a

SHA1
a400c341adaf960022fe4f97ab477e0ab1e02a96

SHA256
12babd301ab2f5a0cd35226d4939e1e200d5fcf90694a25690df7ad0ea28b55a

SHA512
b9f0229e3ed822b79ab2ffa41b67343215bde419a44c638422734f75191f2359bcfeb3553189e17a89b5edfa25016484ec78df48eb05049c72b1d393dd3f4041

Download Submit
\Windows\Installer\MSI26C2.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSI280B.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSI2EE0.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
\Windows\Installer\MSI30F4.tmp
MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
\Windows\Installer\MSI3133.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
\Windows\Installer\MSI33D3.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
\Windows\Installer\MSI3431.tmp
MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
\Windows\Installer\MSI34EF.tmp
MD5
b8255a1bc3c307557741d2c99b8256d1

SHA1
48cc6f3c1a566f06684c5184cf830cbd7db638c2

SHA256
796aea9a46fb7704222a7fe1f4e27455b14640c816d6f961344f89dc47537b33

SHA512
85f685ad84f2208ad87ff34fb5e99edae50fc938a9335cb9747b7707d237c1b397c318090112eee0e9f04777ee004e26e7377f57c3e31159a96638b65110a69c

Download Submit
\Windows\SysWOW64\FM20ENU.DLL
MD5
361d4d77411d2fba1de48c9a6b913cac

SHA1
9f5dfc5a81ab9343b21bf9d88e6d718eaca8a3e4

SHA256
a9116d4f12c9a8d8bf7bb66221c3ba44ff5d0413e10922e8255bf5e687c1d7fa

SHA512
dc03181a9b7147f0ff357f754055a9e74cecd58e9d79c55765417e9533475b93697af34a080b8db4d066198552ab639178591c4cabe427324e979d2d03e54aff

Download Submit
\Windows\SysWOW64\FM20ENU.DLL
MD5
361d4d77411d2fba1de48c9a6b913cac

SHA1
9f5dfc5a81ab9343b21bf9d88e6d718eaca8a3e4

SHA256
a9116d4f12c9a8d8bf7bb66221c3ba44ff5d0413e10922e8255bf5e687c1d7fa

SHA512
dc03181a9b7147f0ff357f754055a9e74cecd58e9d79c55765417e9533475b93697af34a080b8db4d066198552ab639178591c4cabe427324e979d2d03e54aff

Download Submit
memory/288-153-0x0000000000000000-mapping.dmp

Download
memory/388-143-0x0000000000000000-mapping.dmp

Download
memory/516-159-0x0000000000000000-mapping.dmp

Download
memory/572-127-0x0000000000000000-mapping.dmp

Download
memory/748-201-0x0000000000000000-mapping.dmp

Download
memory/748-145-0x0000000000000000-mapping.dmp

Download
memory/812-211-0x0000000000000000-mapping.dmp

Download
memory/840-231-0x0000000000000000-mapping.dmp

Download
memory/944-193-0x0000000000000000-mapping.dmp

Download
memory/944-225-0x0000000000000000-mapping.dmp

Download
memory/1020-58-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1020-57-0x0000000000000000-mapping.dmp

Download
memory/1056-243-0x0000000000000000-mapping.dmp

Download
memory/1240-199-0x0000000000000000-mapping.dmp

Download
memory/1240-229-0x0000000000000000-mapping.dmp

Download
memory/1256-167-0x0000000000000000-mapping.dmp

Download
memory/1272-215-0x0000000000000000-mapping.dmp

Download
memory/1276-241-0x0000000000000000-mapping.dmp

Download
memory/1284-203-0x0000000000000000-mapping.dmp

Download
memory/1288-205-0x0000000000000000-mapping.dmp

Download
memory/1288-233-0x0000000000000000-mapping.dmp

Download
memory/1320-139-0x0000000000000000-mapping.dmp

Download
memory/1336-171-0x0000000000000000-mapping.dmp

Download
memory/1336-185-0x0000000000000000-mapping.dmp

Download
memory/1368-191-0x0000000000000000-mapping.dmp

Download
memory/1380-223-0x0000000000000000-mapping.dmp

Download
memory/1396-157-0x0000000000000000-mapping.dmp

Download
memory/1396-149-0x0000000000000000-mapping.dmp

Download
memory/1400-141-0x0000000000000000-mapping.dmp

Download
memory/1508-245-0x0000000000000000-mapping.dmp

Download
memory/1508-221-0x0000000000000000-mapping.dmp

Download
memory/1508-183-0x0000000000000000-mapping.dmp

Download
memory/1536-237-0x0000000000000000-mapping.dmp

Download
memory/1536-175-0x0000000000000000-mapping.dmp

Download
memory/1572-187-0x0000000000000000-mapping.dmp

Download
memory/1580-207-0x0000000000000000-mapping.dmp

Download
memory/1588-161-0x0000000000000000-mapping.dmp

Download
memory/1608-177-0x0000000000000000-mapping.dmp

Download
memory/1636-217-0x0000000000000000-mapping.dmp

Download
memory/1636-195-0x0000000000000000-mapping.dmp

Download
memory/1636-131-0x0000000000000000-mapping.dmp

Download
memory/1668-169-0x0000000000000000-mapping.dmp

Download
memory/1700-213-0x0000000000000000-mapping.dmp

Download
memory/1704-219-0x0000000000000000-mapping.dmp

Download
memory/1740-227-0x0000000000000000-mapping.dmp

Download
memory/1748-209-0x0000000000000000-mapping.dmp

Download
memory/1776-173-0x0000000000000000-mapping.dmp

Download
memory/1776-147-0x0000000000000000-mapping.dmp

Download
memory/1804-165-0x0000000000000000-mapping.dmp

Download
memory/1804-179-0x0000000000000000-mapping.dmp

Download
memory/1832-239-0x0000000000000000-mapping.dmp

Download
memory/1836-151-0x0000000000000000-mapping.dmp

Download
memory/1936-197-0x0000000000000000-mapping.dmp

Download
memory/1944-135-0x0000000000000000-mapping.dmp

Download
memory/1964-65-0x0000000000000000-mapping.dmp

Download
memory/1968-163-0x0000000000000000-mapping.dmp

Download
memory/1972-181-0x0000000000000000-mapping.dmp

Download
memory/1976-133-0x0000000000000000-mapping.dmp

Download
memory/1976-235-0x0000000000000000-mapping.dmp

Download
memory/1976-189-0x0000000000000000-mapping.dmp

Download
memory/1992-54-0x0000000070351000-0x0000000070353000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1992-56-0x00000000758D1000-0x00000000758D3000-memory.dmp

Filesize
8KB

Download
memory/1992-53-0x00000000728D1000-0x00000000728D4000-memory.dmp

Filesize
12KB

Download
memory/2016-155-0x0000000000000000-mapping.dmp

Download
memory/2024-137-0x0000000000000000-mapping.dmp

Download