db0117eb9a670cfefdb35805f88c7a5e26e5a9f05d6d7592096756f589c717e5

Analysis

max time kernel
146s
max time network
150s
platform
windows7_x64
resource
win7-en
submitted
15-09-2021 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank Details.docx
Size

56KB
MD5

349a235b69a118026fe6345f6163a035
SHA1

74d5c34c8ba87681251e5d0fb30e8b1f0a666c5c
SHA256

db0117eb9a670cfefdb35805f88c7a5e26e5a9f05d6d7592096756f589c717e5
SHA512

0fb015d12f0207e43762532bb9db828dbf794b84163713d59bdc7b0a556c2b367c52d028d5aae60269f6b426092dcff32796fc486c26cbb05e35ce0dde8ee966

Score

10^/10

adware persistence stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 1504 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

wsbis.exewsbis.exe

pid process

1616 wsbis.exe
1552 wsbis.exe
Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

flow	pid	process
7	1504	EQNEDT32.EXE

pid	process
1616	wsbis.exe
1552	wsbis.exe

Loads dropped DLL 64 IoCs

Processes:

EQNEDT32.EXESetup.exeMsiExec.exemsiexec.exeMsiExec.exe

pid	process
1504	EQNEDT32.EXE
800	Setup.exe
800	Setup.exe
300	MsiExec.exe
300	MsiExec.exe
300	MsiExec.exe
300	MsiExec.exe
300	MsiExec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
300	MsiExec.exe
300	MsiExec.exe
2364	MsiExec.exe
2364	MsiExec.exe
2364	MsiExec.exe
2364	MsiExec.exe
2364	MsiExec.exe
2364	MsiExec.exe
1096	msiexec.exe
1096	msiexec.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Setup.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\T:	Setup.exe
File opened (read-only)	\??\V:	Setup.exe
File opened (read-only)	\??\Y:	Setup.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	Setup.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	Setup.exe
File opened (read-only)	\??\E:	Setup.exe
File opened (read-only)	\??\H:	Setup.exe
File opened (read-only)	\??\L:	Setup.exe
File opened (read-only)	\??\O:	Setup.exe
File opened (read-only)	\??\R:	Setup.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	Setup.exe
File opened (read-only)	\??\Z:	Setup.exe
File opened (read-only)	\??\B:	Setup.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	Setup.exe
File opened (read-only)	\??\K:	Setup.exe
File opened (read-only)	\??\M:	Setup.exe
File opened (read-only)	\??\N:	Setup.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	Setup.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	Setup.exe
File opened (read-only)	\??\J:	Setup.exe
File opened (read-only)	\??\Q:	Setup.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	Setup.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	Setup.exe
File opened (read-only)	\??\I:	Setup.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Drops file in System32 directory 2 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\FM20ENU.DLL msiexec.exe
File created C:\Windows\SysWOW64\FM20ENU.DLL msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

wsbis.exe

description pid process target process

PID 1616 set thread context of 1552 1616 wsbis.exe wsbis.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\FM20ENU.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\FM20ENU.DLL	msiexec.exe

description	pid	process	target process
PID 1616 set thread context of 1552	1616	wsbis.exe	wsbis.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\BCSRuntimeRes.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1049\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSCONFIG.CHM	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1041\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1046\hxdsui.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1028\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1041\hxdsui.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\2052\hxdsui.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL.IDX_DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Init.xsn	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL.IDX_DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\3082\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\BCSRuntimeRes.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Sign.xsn	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1046\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Init.xsn	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Init.xsn	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\3082\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1042\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_INIT.XSN	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1036\hxdsui.dll	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OCT.CHM	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ReviewRouting_Review.xsn	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\Xlate_Complete.xsn	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Portal\1033\PortalConnect.dll	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Sign.xsn	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIAFB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEA35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7489.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI815F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f75510f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74C9.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210915112241717.1\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI301E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7ACA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10B3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCBC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2762.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA8D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBB7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f75515f.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6C7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA98.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDAB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2751.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI821D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DBE.tmp	msiexec.exe
File created	C:\Windows\Installer\f75515c.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2772.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f755103.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f755130.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21A2.tmp	msiexec.exe
File created	C:\Windows\Installer\f75517a.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE8D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2F60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE926.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2783.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF107.tmp	msiexec.exe
File created	C:\Windows\Installer\f755159.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBC1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA509.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20210915112241702.2\mfc90jpn.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20210915112241717.1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI165D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f755118.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f755156.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI460.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI14C0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D71.tmp	msiexec.exe
File created	C:\Windows\Installer\f755180.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB0B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6B2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1E1.tmp	msiexec.exe
File created	C:\Windows\Installer\f755165.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f755133.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9CC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E23.tmp	msiexec.exe

Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 2 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXEEQNEDT32.EXE

pid process

1504 EQNEDT32.EXE
1740 EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Modifies data under HKEY_USERS 64 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\3E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\45	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\3E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\49	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\39	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\37	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\42	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\49	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\36	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\3C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\46	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\44	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\40	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\47	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\3A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\40	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\48	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\30	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\08A227DA66DA47944A6D30C473ECB87B\1033\actip10.hlp = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00410063006300650073007300480065006c007000460069006c006500730049006e0074006c005f0031003000330033003e00700070007e0071005300590063006300750038006900440046002100390040002a00510073006f0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VisShe.QuickViewShellExt.1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A394DCA9-3727-11D4-BD85-00C04F6B93A4}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002CE02-0000-0000-C000-000000000046}\InprocHandler32\ = "ole32.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109E60090400000000000F01FEC\TCRecoverFilesIntl_1033	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{F4C48F13-1A7F-46B4-AAAC-02B3FBCD4EDC},ProofDataFile\3082 = 780062002700420056005e007d00740072002600210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c005300700065006c006c0069006e00670041006e0064004700720061006d006d0061007200460069006c00650073005f00330030003800320000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E0E785-BD78-4366-9560-B7DABE2723BE}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109611090400100000000F01FEC	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{863226F8-F40F-48B7-A9B7-0212EE66F812},1033\Fax\originfax.dotx = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A394DCA9-3727-11D4-BD85-00C04F6B93A4}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BCSLaunch.Launcher.1\CLSID\ = "{CB3F7806-3CB4-409C-BA3B-12D642BE371A}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\odcfile\DefaultIcon	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{863226F8-F40F-48B7-A9B7-0212EE66F812},1033\WideScre.pot = 780062002700420056004d002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00500050005400500072006500730065006e0074006100740069006f006e00540065006d0070006c00610074006500730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\68E737A334532CD43AA372757624855C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\0B0F5121FDE82D11AA7A000A9CF0750B	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB10BD80-A331-4e9e-9EB7-00279903AD99}\PersistentAddinsRegistered	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VisShe.QuickViewShellExt\CurVer	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{863226F8-F40F-48B7-A9B7-0212EE66F812},1033\Media_Part.accdt = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00410063006300650073007300540065006d0070006c00610074006500730049006e0074006c0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BCSLaunch.Launcher\ = "Launcher"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odt\PersistentHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0002CE02-0000-0000-C000-000000000046}\VersionIndependentProgID\ = "Equations"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\10BE92CC2CB71D119A12000A9CE1A22A	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\08A227DA66DA47944A6D30C473ECB87B\1033\stslist.chm = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b004c00490053005400460069006c006500730049006e0074006c005f0031003000330033003e004100600025005a00280063002e0060007e003800520050004a007000380079006e00790027004e000000780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b004100430043004500530053004e006f006e0042006f006f007400460069006c006500730049006e0074006c005f0031003000330033003e004100600025005a00280063002e0060007e003800520050004a007000380079006e00790027004e000000780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b0045005800430045004c004e006f006e0042006f006f007400460069006c006500730049006e0074006c005f0031003000330033003e004100600025005a00280063002e0060007e003800520050004a007000380079006e00790027004e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{AD722A80-AD66-4974-A4D6-034C37CE8BB7},1033\EXCEL.DEV.HXS = 780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0045007800630065006c00480065006c007000460069006c006500730000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109A20000000100000000F01FEC\VSTO64	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{4EAD0498-4F35-4FF3-A6A6-3AE68392BA5E},1033 = 780062002700420056004f002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e0000007800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e000000780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057006800690074006500520061006200620069007400480069006400640065006e0000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\CF77AD9C8F812714D856D0EAD5C1DEA1\ProofModelFile\3082 = 780062002700420056005e007d00740072002600210021002100210021004d004b004b0053006b005300700065006c006c0069006e00670041006e0064004700720061006d006d0061007200460069006c00650073005f0033003000380032003e0024004e0073004c005a00600076007d002d003f00360056007d004b004e005300310061004f00670000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LR.LexRefStFrObject.1.0\ = "LexRefStFrObject Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\000041091A0090400000000000F01FEC\OneNoteHelpFilesIntl_1033 = "OneNoteFilesIntl_1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\XEV.GenericApp	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109AB0090400000000000F01FEC\SetupXmlFiles	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{863226F8-F40F-48B7-A9B7-0212EE66F812},1033\107.accdt = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00410063006300650073007300540065006d0070006c00610074006500730049006e0074006c0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.potm\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptm\PersistentHandler	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xevgenxml\ = "XEV.GenericApp"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\VisShe.QuickViewShellExt\CurVer	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{AD722A80-AD66-4974-A4D6-034C37CE8BB7},1033\fm20.chm = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00500072006f006400750063007400460069006c006500730000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{239E8831-E434-421A-A237-02B5DA299DEC},XDocsEditor\1033 = 780062002700420056007a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00580044004f0043005300460069006c00650073000000780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00580044004f004300530045006400690074006f007200460069006c006500730000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{863226F8-F40F-48B7-A9B7-0212EE66F812},1033\EssentialReport.dotx = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.docm\ShellEx\PropertyHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\odcnew.1	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\5EA574A2B057E424E9BFB55A01C0165C\solver.xlam = 780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b0045007800630065006c0041006400640069006e0053006f006c00760065007200460069006c006500730049006e0074006c005f0031003000330033003c0053006f006c0076006500720020004100640064002d0069006e005c0054006f006f006c00200066006f00720020006f007000740069006d0069007a006100740069006f006e00200061006e00640020006500710075006100740069006f006e00200073006f006c00760069006e00670000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75C11604-5C51-48B2-B786-DF5E51D10EC9}\InprocServer32	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{239E8831-E434-421A-A237-02B5DA299DEC},XDocs\1033 = 780062002700420056007a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00580044004f0043005300460069006c006500730000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\107.accdt = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00410063006300650073007300540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e002400470072005f007600340025004a0044003f00610074006a0053005800730070003000450078005b005e0030005d005c003100300037002e006100630063006400740000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LR.LexRefStFrObject.1.0.1	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\B347638FCC3D5BE438A7B3A875C058E2\1033\elegant.dotx = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0057006f007200640051007500690063006b0046006f0072006d00610074007300460069006c006500730049006e0074006c005f0031003000330033003e004300260057006c003f007400680026005400390028007a0033006000720040006d004a00340035005b005e00360030005d0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\PersistentAddinsRegistered	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B3E0E785-BD78-4366-9560-B7DABE2723BE}\ProgID\ = "LR.LexRefStFrObject.1.0.1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\08A227DA66DA47944A6D30C473ECB87B\1033\vbcn6.chm = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00410063006300650073007300480065006c007000460069006c006500730049006e0074006c005f0031003000330033003e004200330042007d004500540055006c006600280045004c0064007100460067006b0057005f0042000000780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00560042004100480065006c007000460069006c006500730049006e0074006c005f0031003000330033003e004200330042007d004500540055006c006600280045004c0064007100460067006b0057005f00420000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{0002CE02-0000-0000-C000-000000000046}\verb\0	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{6679FC01-1CE8-4008-8BFC-06F77A29D4E3},1033 = 780062002700420056004d002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0041006c00770061007900730049006e007300740061006c006c006500640000007800620027004200560050002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0041006c00770061007900730049006e007300740061006c006c00650064000000780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0045005800430045004c00460069006c006500730000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109611090400100000000F01FEC\MsoInstalledPackagesScopedIntl_1033	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{AD722A80-AD66-4974-A4D6-034C37CE8BB7},1033\xmlsdk5.chm = 780062002700420056007a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00580044004f0043005300480065006c007000460069006c006500730000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{863226F8-F40F-48B7-A9B7-0212EE66F812},1033\Status.accft = 780062002700420056004a002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c00410063006300650073007300540065006d0070006c00610074006500730049006e0074006c0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{204DB1B9-42B1-4B21-A1CE-E1BB11F3F3C2}\VersionIndependentProgID\ = "LR.LexRefStArObject.1.0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\ShellEx\PropertyHandler	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{239E8831-E434-421A-A237-02B5DA299DEC},CLVIEW\1033 = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c0041006c00770061007900730049006e007300740061006c006c006500640000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\00004109AB0090400000000000F01FEC	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\ExecutiveNewsletter.dotx = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e003900470046004000260078002b0025004d0039003f005f007b004e0029005d0029003400550063005b005e00340032005d005c0045007800650063007500740069007600650020004e006500770073006c00650074007400650072002e0064006f007400780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\8F622368F04F7B849A7B2021EE668F21\1033\OlMergFx.dot = 7800620027004200560050002800380041002400210021002100210021004d004b004b0053006b0057004f005200440044006f00630075006d0065006e007400540065006d0070006c00610074006500730049006e0074006c005f0031003000330033003e006700720026003d003900430076003d005a003800620060006a006a002e007a004600460037003f005b005e00320046005d005c004f007200690065006c0020004d00650072006700650020004600610078002e0064006f007400780000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{FC5F6372-D8B6-43D0-B244-0B49B07F743C},1033\cagcat10.mml = 780062002700420056004e002900380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c004300410047004300610074003100300000000000	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\613B99D5CFD7FCB4793B500086BB4113\{F4C48F13-1A7F-46B4-AAAC-02B3FBCD4EDC},ProofDataFile\1033 = 7800620027004200560054002800380041002400210021002100210021004d004b004b0053006b00470069006d006d0065005f004f006e00440065006d0061006e00640044006100740061003c005300700065006c006c0069006e00670041006e0064004700720061006d006d0061007200460069006c00650073005f00310030003300330000000000	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1316 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exe

pid process

1096 msiexec.exe
1096 msiexec.exe
1096 msiexec.exe
1096 msiexec.exe
1096 msiexec.exe
1096 msiexec.exe
1096 msiexec.exe
1096 msiexec.exe

pid	process
1316	WINWORD.EXE

pid	process
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe
1096	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wsbis.exevssvc.exeDrvInst.exeSetup.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1616	wsbis.exe
Token: SeBackupPrivilege	2032	vssvc.exe
Token: SeRestorePrivilege	2032	vssvc.exe
Token: SeAuditPrivilege	2032	vssvc.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeRestorePrivilege	1656	DrvInst.exe
Token: SeLoadDriverPrivilege	1656	DrvInst.exe
Token: SeLoadDriverPrivilege	1656	DrvInst.exe
Token: SeLoadDriverPrivilege	1656	DrvInst.exe
Token: SeShutdownPrivilege	800	Setup.exe
Token: SeIncreaseQuotaPrivilege	800	Setup.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeSecurityPrivilege	1096	msiexec.exe
Token: SeCreateTokenPrivilege	800	Setup.exe
Token: SeAssignPrimaryTokenPrivilege	800	Setup.exe
Token: SeLockMemoryPrivilege	800	Setup.exe
Token: SeIncreaseQuotaPrivilege	800	Setup.exe
Token: SeMachineAccountPrivilege	800	Setup.exe
Token: SeTcbPrivilege	800	Setup.exe
Token: SeSecurityPrivilege	800	Setup.exe
Token: SeTakeOwnershipPrivilege	800	Setup.exe
Token: SeLoadDriverPrivilege	800	Setup.exe
Token: SeSystemProfilePrivilege	800	Setup.exe
Token: SeSystemtimePrivilege	800	Setup.exe
Token: SeProfSingleProcessPrivilege	800	Setup.exe
Token: SeIncBasePriorityPrivilege	800	Setup.exe
Token: SeCreatePagefilePrivilege	800	Setup.exe
Token: SeCreatePermanentPrivilege	800	Setup.exe
Token: SeBackupPrivilege	800	Setup.exe
Token: SeRestorePrivilege	800	Setup.exe
Token: SeShutdownPrivilege	800	Setup.exe
Token: SeDebugPrivilege	800	Setup.exe
Token: SeAuditPrivilege	800	Setup.exe
Token: SeSystemEnvironmentPrivilege	800	Setup.exe
Token: SeChangeNotifyPrivilege	800	Setup.exe
Token: SeRemoteShutdownPrivilege	800	Setup.exe
Token: SeUndockPrivilege	800	Setup.exe
Token: SeSyncAgentPrivilege	800	Setup.exe
Token: SeEnableDelegationPrivilege	800	Setup.exe
Token: SeManageVolumePrivilege	800	Setup.exe
Token: SeImpersonatePrivilege	800	Setup.exe
Token: SeCreateGlobalPrivilege	800	Setup.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXEwsbis.exe

pid process

1316 WINWORD.EXE
1316 WINWORD.EXE
1316 WINWORD.EXE
1552 wsbis.exe

pid	process
1316	WINWORD.EXE
1316	WINWORD.EXE
1316	WINWORD.EXE
1552	wsbis.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WINWORD.EXEEQNEDT32.EXEwsbis.exemsiexec.exe

description	pid	process	target process
PID 1316 wrote to memory of 1080	1316	WINWORD.EXE	splwow64.exe
PID 1316 wrote to memory of 1080	1316	WINWORD.EXE	splwow64.exe
PID 1316 wrote to memory of 1080	1316	WINWORD.EXE	splwow64.exe
PID 1316 wrote to memory of 1080	1316	WINWORD.EXE	splwow64.exe
PID 1504 wrote to memory of 1616	1504	EQNEDT32.EXE	wsbis.exe
PID 1504 wrote to memory of 1616	1504	EQNEDT32.EXE	wsbis.exe
PID 1504 wrote to memory of 1616	1504	EQNEDT32.EXE	wsbis.exe
PID 1504 wrote to memory of 1616	1504	EQNEDT32.EXE	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1616 wrote to memory of 1552	1616	wsbis.exe	wsbis.exe
PID 1096 wrote to memory of 300	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 300	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 300	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 300	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 300	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 300	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 300	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2364	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2364	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2364	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2364	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2364	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2364	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2364	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2512	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2512	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2512	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2512	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2512	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2512	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2512	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2580	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2580	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2580	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2580	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2580	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2580	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2580	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2656	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2656	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2656	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2656	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2656	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2656	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2656	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2788	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2788	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2788	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2788	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2788	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2788	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2788	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2860	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2860	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2860	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2860	1096	msiexec.exe	MsiExec.exe
PID 1096 wrote to memory of 2860	1096	msiexec.exe	MsiExec.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Bank Details.docx"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1080

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Public\wsbis.exe
C:\Users\Public\wsbis.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616

C:\Users\Public\wsbis.exe
"C:\Users\Public\wsbis.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Launches Equation Editor
PID:1740

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot10" "" "" "699077f33" "0000000000000000" "00000000000005A0" "00000000000005E0"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 714E2999495E38B2C0B751058CF80329
2⤵
- Loads dropped DLL
PID:300

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 335FA727D927815743762E56C0FC00A5 M Global\MSI0000
2⤵
- Loads dropped DLL
PID:2364

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 89C2917D8E17E10E844B818B1B157C24
2⤵
PID:2512

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 3DDED074CDD7D42ABA59FCA4C856E9DD
2⤵
PID:2580

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9681F0F1427103C41CBBEA196E68F5BD M Global\MSI0000
2⤵
PID:2656

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5A959A4793C5638517D84C0F34AAA886
2⤵
PID:2788

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 45B1DCA3D1E7CD3C1A8D245022292A05 M Global\MSI0000
2⤵
PID:2860

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 31D3DC6B2ACEDFC6FCDFE1D0A19126BE
2⤵
PID:2988

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CBF0DC8E20E0D2A20EC1426B5043BAE0 M Global\MSI0000
2⤵
PID:3060

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 955AE945C02B464271F331A1A6E2080A
2⤵
PID:2176

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AD36605131E3DB5D092F895A0EEECA19 M Global\MSI0000
2⤵
PID:2248

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5CD42A58F3A7DB7B990A87A653C309DB
2⤵
PID:1272

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E9C63C51A1BA54B26E126051BB9972E4
2⤵
PID:1504

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7B86FD7B5FA8F77885A67B8642ADB136
2⤵
PID:2464

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CEF63C4BC877B18DA2C9DCE79E2D9057
2⤵
PID:2388

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2142523B706BAD99CC35F5B9B2465A21
2⤵
PID:2556

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DB086C8679C795D115404F473D7CD29A
2⤵
PID:2628

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 69731A4C6FBD7EC79DAAA0BEF91E1FAF
2⤵
PID:2736

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5D30B3FC52CCBD412B4D275E098394EC M Global\MSI0000
2⤵
PID:2584

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FB33AFB6C955C5E41CF22D8D27FA1825
2⤵
PID:2924

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding EF25E0B6219CF458A49BA3420799FC38 M Global\MSI0000
2⤵
PID:2896

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D9AF61A4B143BA28BF5CB54D2694B4CC
2⤵
PID:2132

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E003C4C330C6D92662A491F7FC54971B M Global\MSI0000
2⤵
PID:2992

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 4A5EA3ABBFD4E0ACFAAEEDF9E9CA6D0B
2⤵
PID:2316

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C12A6102F5D3DA23D9A3BC03F1704217
2⤵
PID:2192

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A2565250B89EC891753F2E5E734E06B6 M Global\MSI0000
2⤵
PID:2360

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AA443264D828C0938FD5C05D228479F5
2⤵
PID:2476

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1507D9573551056AF339D396CBEABBC6 M Global\MSI0000
2⤵
PID:2380

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 336495144324E1A8EDBC7463AE8E6FEB
2⤵
PID:2648

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 0EB19C8B54C93C35BD721530C1DBF4B4
2⤵
PID:2716

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 159278AD103EEF10989F0D5FE80EBFD3
2⤵
PID:2780

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 1433F617FACDA55DBB8D06857A478068 M Global\MSI0000
2⤵
PID:2660

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 85E7E65151F0E174C9C7FDC7C5F2117F
2⤵
PID:3000

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 38BA6378CF3A1AF4D0F68DF51F3330EE M Global\MSI0000
2⤵
PID:2920

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 154473F0CFCA0AE2F966A0061A2ECBA5
2⤵
PID:3060

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 60D242584633DD723501D8EDCC58838E
2⤵
PID:2244

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 24C3426948C9924FBEBBCF22C9E98FBF M Global\MSI0000
2⤵
PID:2132

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 692157E4E0B7E184BC16D027DA17687A
2⤵
PID:2424

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 63C313D513DB9F071E243F0BDA001052 M Global\MSI0000
2⤵
PID:2028

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B3F49F99DAF61F4ABC5E2481BD77DF77
2⤵
PID:2540

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 548A1BFCB4A4BBD7887E1BCFAB0756E1 M Global\MSI0000
2⤵
PID:2480

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A52D0F6E0EECC2214AF7B653ED4A3F8E
2⤵
PID:2712

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 31C1224FD12910AA556B87959BFE8468
2⤵
PID:2688

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AD81D86ABD9EBA192DE65A143CB4194C
2⤵
PID:2724

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7E1CED7D01BEC322902CA3B4829C7CFB
2⤵
PID:2816

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F553537CD96B6C62BC8656C672553273
2⤵
PID:2844

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9E40C6687C3DA0284EB7C5EC2DA551ED
2⤵
PID:2092

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A0F29F51F645A38048B66C00B16B2403
2⤵
PID:2976

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 83A0FD1095A0FC1BF557643F7AC73B79 M Global\MSI0000
2⤵
PID:3024

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9987118D291662F0E8EF528194486C8C
2⤵
PID:2144

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E6C6EB51D4D45FBBA778509F78AF1BC0 M Global\MSI0000
2⤵
PID:2264

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 6F8A518C635DC6E0FE147673205B7B02
2⤵
PID:2428

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F3AEABEC61A84EED526C69EA09A4268D M Global\MSI0000
2⤵
PID:2484

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 45141C0B2E669AB30181F41476EEB2A3
2⤵
PID:2532

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding CF095E756AF63E4F4670C8316CD4C960 M Global\MSI0000
2⤵
PID:2504

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 5BBDF0E490C12FC97DA6C6012178CAEC
2⤵
PID:2624

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AA5A7E3AE889379D21DF942DBE897B26
2⤵
PID:2560

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding AEE69F81FBDB4AAEC171A7186FC47546 M Global\MSI0000
2⤵
PID:2732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\wsbis.exe
MD5
3e59fa59bd61e4fd87d179b719b21862

SHA1
8f7ce0a996037364a52aaf94d767b36efaf096e9

SHA256
26bec6114e67239a103b0c33fef33c802a77703a71ef3a204222454b994dbcf4

SHA512
b19427131293e4548128cfc44bb3d4bd7bfb8dcee552bbd5e5f3173a6786691b49113bb4112f6c2c5ccbf9f0a88977c96c3adb966cbbf73db46af8da2a8c92bb

Download Submit
C:\Users\Public\wsbis.exe
MD5
3e59fa59bd61e4fd87d179b719b21862

SHA1
8f7ce0a996037364a52aaf94d767b36efaf096e9

SHA256
26bec6114e67239a103b0c33fef33c802a77703a71ef3a204222454b994dbcf4

SHA512
b19427131293e4548128cfc44bb3d4bd7bfb8dcee552bbd5e5f3173a6786691b49113bb4112f6c2c5ccbf9f0a88977c96c3adb966cbbf73db46af8da2a8c92bb

Download Submit
C:\Users\Public\wsbis.exe
MD5
3e59fa59bd61e4fd87d179b719b21862

SHA1
8f7ce0a996037364a52aaf94d767b36efaf096e9

SHA256
26bec6114e67239a103b0c33fef33c802a77703a71ef3a204222454b994dbcf4

SHA512
b19427131293e4548128cfc44bb3d4bd7bfb8dcee552bbd5e5f3173a6786691b49113bb4112f6c2c5ccbf9f0a88977c96c3adb966cbbf73db46af8da2a8c92bb

Download Submit
C:\Windows\Installer\MSI4D07.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSI4E40.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSI568C.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
C:\Windows\Installer\MSI58BE.tmp
MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSI58FE.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
C:\Windows\Installer\MSI5BEC.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL
MD5
f3e1265f2f72f0f30464c19fc0d9263d

SHA1
a63a10d4b34916cfc0d1b9d990244710b25b4b0f

SHA256
092167fb8180160d65ab2f79cc9fba22ef91580af15be7bcddb27ac5613f34dd

SHA512
b5b4c86ec9b107d9bf501fe4597394d0eec5c0ea08135a38cbfd583e56662e311033ebfd5bab312e51f4fb3d2733d3d40b482a1af1ed1d855c067bafd1476b88

Download Submit
\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL
MD5
f3e1265f2f72f0f30464c19fc0d9263d

SHA1
a63a10d4b34916cfc0d1b9d990244710b25b4b0f

SHA256
092167fb8180160d65ab2f79cc9fba22ef91580af15be7bcddb27ac5613f34dd

SHA512
b5b4c86ec9b107d9bf501fe4597394d0eec5c0ea08135a38cbfd583e56662e311033ebfd5bab312e51f4fb3d2733d3d40b482a1af1ed1d855c067bafd1476b88

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll
MD5
e4d4a3de0c14a9f671bd51bf1ae3871c

SHA1
9cf4eb26d5738278bac70d67d4116553bd6bae4b

SHA256
4f0bfc8d0c92768ac3b06b777bbd0546d40ea84ededc165f36e6e95289643379

SHA512
ecd6463924d2802b7185e44b98ec555f70c6b061bbeaed27c6dce7432df48ed6e16721db47452b101ac9c533e9518c25c4a1beeacd14442ab85987f7fab01fdf

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll
MD5
e4d4a3de0c14a9f671bd51bf1ae3871c

SHA1
9cf4eb26d5738278bac70d67d4116553bd6bae4b

SHA256
4f0bfc8d0c92768ac3b06b777bbd0546d40ea84ededc165f36e6e95289643379

SHA512
ecd6463924d2802b7185e44b98ec555f70c6b061bbeaed27c6dce7432df48ed6e16721db47452b101ac9c533e9518c25c4a1beeacd14442ab85987f7fab01fdf

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll
MD5
90b238e111675742ca28f75681d61661

SHA1
6b3201576b54e68bdcef6fe86a0a5a476546447b

SHA256
87d3e4fb8f0023c8dfb6c3fa1d5589b51887f2a06ef9d87ee7efc470c571072b

SHA512
f99add04f9528347f5ee2612194595d2512c7a9e2d37c9b99251a72680c652a0c1733176cb70abc29e06988e455a278a1bc50b71f4e17a20a4afd8ddd2bcacfa

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll
MD5
90b238e111675742ca28f75681d61661

SHA1
6b3201576b54e68bdcef6fe86a0a5a476546447b

SHA256
87d3e4fb8f0023c8dfb6c3fa1d5589b51887f2a06ef9d87ee7efc470c571072b

SHA512
f99add04f9528347f5ee2612194595d2512c7a9e2d37c9b99251a72680c652a0c1733176cb70abc29e06988e455a278a1bc50b71f4e17a20a4afd8ddd2bcacfa

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll
MD5
e51ccbe599c54365f60a653f00fb6b59

SHA1
dae0f5d259e090029f00b20ae6e92b2f30f418a9

SHA256
856681f9d3dc69ea52a252355497ec89d8e31260801edb4da387f65037bac91a

SHA512
8aad801ea7bea8383ca90b2188ddefb616361b58388dcd2307301101ad7b7268395d516bb517a06784701292c96bf2b359d94abb02618072b6a8fdee23356999

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll
MD5
e51ccbe599c54365f60a653f00fb6b59

SHA1
dae0f5d259e090029f00b20ae6e92b2f30f418a9

SHA256
856681f9d3dc69ea52a252355497ec89d8e31260801edb4da387f65037bac91a

SHA512
8aad801ea7bea8383ca90b2188ddefb616361b58388dcd2307301101ad7b7268395d516bb517a06784701292c96bf2b359d94abb02618072b6a8fdee23356999

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll
MD5
7d26561d455c8a8e209d680b0d9bc6aa

SHA1
262b41f9d8d44fce5dd4f350dae520b986dff51d

SHA256
0d0925e02b163157fb1686e9ad0a2b6ccc70399f87efd6f1235d360415a3030a

SHA512
abda368f0613b3cc1f16aedddf5796cd53b1c3494fbaa6a2a3ab5d119175e4faf7bcfda9aeaa94dadcc7f7ced8a0ce3fe3964d4ae93b6a79f54b39ddcb10b285

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll
MD5
7d26561d455c8a8e209d680b0d9bc6aa

SHA1
262b41f9d8d44fce5dd4f350dae520b986dff51d

SHA256
0d0925e02b163157fb1686e9ad0a2b6ccc70399f87efd6f1235d360415a3030a

SHA512
abda368f0613b3cc1f16aedddf5796cd53b1c3494fbaa6a2a3ab5d119175e4faf7bcfda9aeaa94dadcc7f7ced8a0ce3fe3964d4ae93b6a79f54b39ddcb10b285

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll
MD5
85d90766b76a5036d29a0d98c1dae439

SHA1
d4d1631c834156be8c451400b014d45c9b8df188

SHA256
b5d4f362ac5e9a3090a2f8f17028e769d39cd3cac535375124701a3699203fc6

SHA512
8875523b25f122a9fe9c644b42275ef1e0a37c6621dcf81ec1382f99d8042ab282c67fd2a03486c6b8c2432ee55374bdba85602445011b50ccf055d6b7a4de81

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll
MD5
85d90766b76a5036d29a0d98c1dae439

SHA1
d4d1631c834156be8c451400b014d45c9b8df188

SHA256
b5d4f362ac5e9a3090a2f8f17028e769d39cd3cac535375124701a3699203fc6

SHA512
8875523b25f122a9fe9c644b42275ef1e0a37c6621dcf81ec1382f99d8042ab282c67fd2a03486c6b8c2432ee55374bdba85602445011b50ccf055d6b7a4de81

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll
MD5
53ecaf0ed506967df2a045b75ed52e24

SHA1
8d9d80ba0b959e39a51c6f98c790bc15b7e1a661

SHA256
08ff8c6aee190de31a999ca7adf0c9f84105388059abe98b8338c0b86c079f21

SHA512
e467633564be38935dd2154a9408bd79789e920dcffa46dd5a9eaab3dd5c4f883dac79c3a0b90224f82ee124db00b5e18b052203011ee9ba2193c814cc5ddf59

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll
MD5
53ecaf0ed506967df2a045b75ed52e24

SHA1
8d9d80ba0b959e39a51c6f98c790bc15b7e1a661

SHA256
08ff8c6aee190de31a999ca7adf0c9f84105388059abe98b8338c0b86c079f21

SHA512
e467633564be38935dd2154a9408bd79789e920dcffa46dd5a9eaab3dd5c4f883dac79c3a0b90224f82ee124db00b5e18b052203011ee9ba2193c814cc5ddf59

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll
MD5
8cec568e66cab7a5cf8a14d850fbb002

SHA1
289790c09d5ff4b5ab879945fa33f1ec679b2299

SHA256
3b5c2165335de6286809371b6e1ae8f4c0d3b3da5e9b3ac0ff56e9c49572df60

SHA512
f3c4b7a4d02052c962a46c91a176fead0d52619422658f45b0e3e710e98070b7a14ad0f1804b7e12b789c26fb1df25356668212e30102a3e6d570d7cbe170c2b

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll
MD5
8cec568e66cab7a5cf8a14d850fbb002

SHA1
289790c09d5ff4b5ab879945fa33f1ec679b2299

SHA256
3b5c2165335de6286809371b6e1ae8f4c0d3b3da5e9b3ac0ff56e9c49572df60

SHA512
f3c4b7a4d02052c962a46c91a176fead0d52619422658f45b0e3e710e98070b7a14ad0f1804b7e12b789c26fb1df25356668212e30102a3e6d570d7cbe170c2b

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll
MD5
44eb9257752e952193faf408bf3abc57

SHA1
58bc265c8ef47d41fa50a83c347a035ef2aa2bd0

SHA256
136e3b1202b60425376d7214450e33d7daaaeb6c44a13e457875ab6a3680b179

SHA512
21a7d2cb785fcd3cfda5596f10906f4cf86ad83f43480db7d2e13e3b9068d48956f8afbdaab136dd755424dac5b214d2fbd61616c402cce3c6510c167250c13a

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll
MD5
44eb9257752e952193faf408bf3abc57

SHA1
58bc265c8ef47d41fa50a83c347a035ef2aa2bd0

SHA256
136e3b1202b60425376d7214450e33d7daaaeb6c44a13e457875ab6a3680b179

SHA512
21a7d2cb785fcd3cfda5596f10906f4cf86ad83f43480db7d2e13e3b9068d48956f8afbdaab136dd755424dac5b214d2fbd61616c402cce3c6510c167250c13a

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll
MD5
74b19a2653267fdeaa6c6d3ddf3a0a9a

SHA1
7db8df8d30f83dda8dce9b00a44e183c81f02427

SHA256
ca8356bad057117751142f489ce26937fc47f564700071638371e5e49c5746a4

SHA512
0453798ee131cc2bd46ea02a683541e2d46c9d81231e4d95c1d7192e5e691c639277828b2726dd76f9caeffb2a7941db9e7d47a4b4c03abb329ce3a57e6170ab

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll
MD5
74b19a2653267fdeaa6c6d3ddf3a0a9a

SHA1
7db8df8d30f83dda8dce9b00a44e183c81f02427

SHA256
ca8356bad057117751142f489ce26937fc47f564700071638371e5e49c5746a4

SHA512
0453798ee131cc2bd46ea02a683541e2d46c9d81231e4d95c1d7192e5e691c639277828b2726dd76f9caeffb2a7941db9e7d47a4b4c03abb329ce3a57e6170ab

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll
MD5
8bd9dd8f8fc5a876ce73159ad63d77f4

SHA1
78e8d2720f4a12f6699a6ac421ba32c5d15e427a

SHA256
ce6707b76876170c8609644599117da8853d14e8c46acedaf145b2f7aa9f7590

SHA512
9a0049994315ec9d0ee66b2f3e33c9cb1472b18aee95e4c5072f64c7aef40d2c87ff69529a373a78ff1be5ded5504ae3d1200df8b81ee148fcfffa44ddfc737c

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll
MD5
8bd9dd8f8fc5a876ce73159ad63d77f4

SHA1
78e8d2720f4a12f6699a6ac421ba32c5d15e427a

SHA256
ce6707b76876170c8609644599117da8853d14e8c46acedaf145b2f7aa9f7590

SHA512
9a0049994315ec9d0ee66b2f3e33c9cb1472b18aee95e4c5072f64c7aef40d2c87ff69529a373a78ff1be5ded5504ae3d1200df8b81ee148fcfffa44ddfc737c

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll
MD5
b0421e0fc013d4b57dba92f4ac2fda04

SHA1
0a6ef388b6570f384b1a1fce16ccb9731a0484bc

SHA256
2b31902a74bcd0247764a1fcc40514b8adf5a2dd881a7b07148d8e74339458ca

SHA512
d7ce694350bb7f6543d4b650c4fefc1236914d2226b5c5ac1aae5e9b4d9dab7e0ae16e1e8f326128ec270c97a7d9f297960b03fb1e91565acd087a32153a3880

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll
MD5
b0421e0fc013d4b57dba92f4ac2fda04

SHA1
0a6ef388b6570f384b1a1fce16ccb9731a0484bc

SHA256
2b31902a74bcd0247764a1fcc40514b8adf5a2dd881a7b07148d8e74339458ca

SHA512
d7ce694350bb7f6543d4b650c4fefc1236914d2226b5c5ac1aae5e9b4d9dab7e0ae16e1e8f326128ec270c97a7d9f297960b03fb1e91565acd087a32153a3880

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL
MD5
0f45ff4af4c58c9391fca2d83a227877

SHA1
39c22315e9588b4da0cc4aba40131df4b58f0c65

SHA256
6b10a06fe12810d77cd4acaac9b016672cabd31b49d9497f71d418d0ba699049

SHA512
050781f003c6c51b7924f95c5e14ef64459f6915bc3efe96ac62d75ea23c36d988a8ed5cf59829ffedb9334e7771efac2859403ba8f2c7a6ad1c3a60349ddf9d

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL
MD5
0f45ff4af4c58c9391fca2d83a227877

SHA1
39c22315e9588b4da0cc4aba40131df4b58f0c65

SHA256
6b10a06fe12810d77cd4acaac9b016672cabd31b49d9497f71d418d0ba699049

SHA512
050781f003c6c51b7924f95c5e14ef64459f6915bc3efe96ac62d75ea23c36d988a8ed5cf59829ffedb9334e7771efac2859403ba8f2c7a6ad1c3a60349ddf9d

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll
MD5
8dc70c718cfe61c8017c0dbc43343e92

SHA1
de644e1f049124083f6cca9e6ac2f37cbdceb936

SHA256
7be147891e8b70b2a217f57e9242e669a352c0adfc8798cfef6c9d8f3e478d89

SHA512
a73a781f127721ca4b9a6f10dc712acb4a5248974301c36f88923dbda6f1309f45dae506bfca8d93be196ea97db3c82c16ca5f356b3677aa98eb45c9dcf2cfb6

Download Submit
\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll
MD5
8dc70c718cfe61c8017c0dbc43343e92

SHA1
de644e1f049124083f6cca9e6ac2f37cbdceb936

SHA256
7be147891e8b70b2a217f57e9242e669a352c0adfc8798cfef6c9d8f3e478d89

SHA512
a73a781f127721ca4b9a6f10dc712acb4a5248974301c36f88923dbda6f1309f45dae506bfca8d93be196ea97db3c82c16ca5f356b3677aa98eb45c9dcf2cfb6

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL
MD5
bbf8782c834372d50599272e1761abf4

SHA1
e6abbae824fbf6c3db00bcc709d725e48f0911ba

SHA256
4cc94dd1764ad4b6eada16b98c4f108b7be0fd622cee573b91ca9ea8cc5829bb

SHA512
3a94b4dbe0628220a3b1bbdacec6d2fb7f47d8533bcca24415dc3c0ef330a44937cf93a4c83127ab1486926c76039ffad86372c2deab8cb94f2d1ccf6f45f042

Download Submit
\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL
MD5
bbf8782c834372d50599272e1761abf4

SHA1
e6abbae824fbf6c3db00bcc709d725e48f0911ba

SHA256
4cc94dd1764ad4b6eada16b98c4f108b7be0fd622cee573b91ca9ea8cc5829bb

SHA512
3a94b4dbe0628220a3b1bbdacec6d2fb7f47d8533bcca24415dc3c0ef330a44937cf93a4c83127ab1486926c76039ffad86372c2deab8cb94f2d1ccf6f45f042

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BCSRuntimeRes.dll
MD5
489e68a40665d8b9189e9914ed652860

SHA1
a098d84098ec2d270e9648aecf52ece6b214d810

SHA256
71aa309ca25ae19e306584ecd272649d4971e2f909acbb619159fd138e383f8b

SHA512
51cec82e9c2fd01b363bffcd6b6178920fba657532e1ba3c11e6dd233cf7c76923a0246fe43fd3675b03877af4267d540708400f7c69792203b6b242c5638d74

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BCSRuntimeRes.dll
MD5
489e68a40665d8b9189e9914ed652860

SHA1
a098d84098ec2d270e9648aecf52ece6b214d810

SHA256
71aa309ca25ae19e306584ecd272649d4971e2f909acbb619159fd138e383f8b

SHA512
51cec82e9c2fd01b363bffcd6b6178920fba657532e1ba3c11e6dd233cf7c76923a0246fe43fd3675b03877af4267d540708400f7c69792203b6b242c5638d74

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL
MD5
6e81fc49020455eec05de61d3a75b89d

SHA1
a5a082362cfae8f1127f88e3b25647b766dd34af

SHA256
9eb326a4338cc9e8e1c7af79db0f51b44e95aa0733372f623a6b9d36dcb15fe3

SHA512
bca5011ae15b42445f79baed7752c09d04ec276f4a7c78ba07e9ff0e3dec8070e270c51801cf02e77e339d045dbb7efb71eb7063da95011ea3e3e942587bb4eb

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL
MD5
6e81fc49020455eec05de61d3a75b89d

SHA1
a5a082362cfae8f1127f88e3b25647b766dd34af

SHA256
9eb326a4338cc9e8e1c7af79db0f51b44e95aa0733372f623a6b9d36dcb15fe3

SHA512
bca5011ae15b42445f79baed7752c09d04ec276f4a7c78ba07e9ff0e3dec8070e270c51801cf02e77e339d045dbb7efb71eb7063da95011ea3e3e942587bb4eb

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EAWFINTL.DLL
MD5
e9018bb84192a96a99677a715b638013

SHA1
eaf2079894af4cc93411d9eb01cb7095b8859278

SHA256
fe26756547e4a52c4eeda3f3b29528052c157a93ea1f8c6254679be3152f777b

SHA512
f3a7b59caaab4ad0608bc8538ef79352033cdc561ca4384eacdd6b879db430c0e2388cb6b7e06736cd8727f7e50c7bc91919304fcf053f96ee8206be7ffe5949

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EAWFINTL.DLL
MD5
e9018bb84192a96a99677a715b638013

SHA1
eaf2079894af4cc93411d9eb01cb7095b8859278

SHA256
fe26756547e4a52c4eeda3f3b29528052c157a93ea1f8c6254679be3152f777b

SHA512
f3a7b59caaab4ad0608bc8538ef79352033cdc561ca4384eacdd6b879db430c0e2388cb6b7e06736cd8727f7e50c7bc91919304fcf053f96ee8206be7ffe5949

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EntityPickerIntl.dll
MD5
b46debbb3b0a16492a76ec167ddfd349

SHA1
af588fb0fcd67f604c7af62cf378b9d0c5634621

SHA256
8c3643813ce0b4b882616f38273f0459bb5712d8cf16e837deaf90eeb9d09d1b

SHA512
6ce4571eebc01d0ddb35468c0299be348f18942bf318a569af24b0a4f9907e48220d3ec76216e2f9c664c5b19dad03ce89794f5f799e5e84472d18e7197fea4a

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\EntityPickerIntl.dll
MD5
b46debbb3b0a16492a76ec167ddfd349

SHA1
af588fb0fcd67f604c7af62cf378b9d0c5634621

SHA256
8c3643813ce0b4b882616f38273f0459bb5712d8cf16e837deaf90eeb9d09d1b

SHA512
6ce4571eebc01d0ddb35468c0299be348f18942bf318a569af24b0a4f9907e48220d3ec76216e2f9c664c5b19dad03ce89794f5f799e5e84472d18e7197fea4a

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\OFFOWCI.DLL
MD5
7f97c66e925f9fa7a6fb5e56cc2c003a

SHA1
cd875f7029a055dec68066654250a12c4e7bec86

SHA256
53aacdca9f61559a5e2147dc5ea941683fb6d195378f682864c3a06bf0aa1fb6

SHA512
9003d7a07ce56352e7792d442924f29f58269f872173413e4f03c77e4f9a9b6b059337bf7ae5008ea4600c083476046970e8cd036b6939cf5a914872b90bbd20

Download Submit
\Program Files (x86)\Microsoft Office\Office14\1033\OFFOWCI.DLL
MD5
7f97c66e925f9fa7a6fb5e56cc2c003a

SHA1
cd875f7029a055dec68066654250a12c4e7bec86

SHA256
53aacdca9f61559a5e2147dc5ea941683fb6d195378f682864c3a06bf0aa1fb6

SHA512
9003d7a07ce56352e7792d442924f29f58269f872173413e4f03c77e4f9a9b6b059337bf7ae5008ea4600c083476046970e8cd036b6939cf5a914872b90bbd20

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\1036\ENVELOPR.DLL.trx_dll
MD5
10fa6ecb335d75b17d2c3ac4f3cbaabb

SHA1
0f549eed3c20f7178f2b6f12cb8f3c0dcf022f94

SHA256
1dd89f6d6d5159abd258bf7c0126382986781bee81ad7f7da15e50f2db8e45b8

SHA512
c55f5986fb3ba8d2828d0428a8599cfc1e2b1db7263ffc4bedcc016a3ba47539534685b3dfa0edaff5a8e90a7272cac113cedb3ae672cb43a8a6c42040c1ac01

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\1036\ENVELOPR.DLL.trx_dll
MD5
10fa6ecb335d75b17d2c3ac4f3cbaabb

SHA1
0f549eed3c20f7178f2b6f12cb8f3c0dcf022f94

SHA256
1dd89f6d6d5159abd258bf7c0126382986781bee81ad7f7da15e50f2db8e45b8

SHA512
c55f5986fb3ba8d2828d0428a8599cfc1e2b1db7263ffc4bedcc016a3ba47539534685b3dfa0edaff5a8e90a7272cac113cedb3ae672cb43a8a6c42040c1ac01

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\3082\ENVELOPR.DLL.trx_dll
MD5
d9cec19cdbe418dc49759eddf7572a2e

SHA1
96b165af2f03dbd70825997321f4e0fd1d20a6d8

SHA256
0d3c16cbd05a5cd725e44f5053f69bf1901260eee7ae306a376dc87f2b452509

SHA512
dcf6ea16210e723875dea2e6526399a61398c34bc60f35dbc7eed3ae27c7f6a9c3d8ce55dde24bf4105c8298d9f25fddfb511dce5b5add0dd347817e038c6e00

Download Submit
\ProgramData\Microsoft\OFFICE\UICaptions\3082\ENVELOPR.DLL.trx_dll
MD5
d9cec19cdbe418dc49759eddf7572a2e

SHA1
96b165af2f03dbd70825997321f4e0fd1d20a6d8

SHA256
0d3c16cbd05a5cd725e44f5053f69bf1901260eee7ae306a376dc87f2b452509

SHA512
dcf6ea16210e723875dea2e6526399a61398c34bc60f35dbc7eed3ae27c7f6a9c3d8ce55dde24bf4105c8298d9f25fddfb511dce5b5add0dd347817e038c6e00

Download Submit
\Users\Admin\AppData\Local\Temp\Setup00000320\OSETUP.DLL
MD5
fcc38158c5d62a39e1ba79a29d532240

SHA1
eca2d1e91c634bc8a4381239eb05f30803636c24

SHA256
e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74

SHA512
0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7

Download Submit
\Users\Admin\AppData\Local\Temp\Setup00000320\OSETUPUI.DLL
MD5
196a884e700b7eb09b2cd0a48eccbc3a

SHA1
a400c341adaf960022fe4f97ab477e0ab1e02a96

SHA256
12babd301ab2f5a0cd35226d4939e1e200d5fcf90694a25690df7ad0ea28b55a

SHA512
b9f0229e3ed822b79ab2ffa41b67343215bde419a44c638422734f75191f2359bcfeb3553189e17a89b5edfa25016484ec78df48eb05049c72b1d393dd3f4041

Download Submit
\Users\Public\wsbis.exe
MD5
3e59fa59bd61e4fd87d179b719b21862

SHA1
8f7ce0a996037364a52aaf94d767b36efaf096e9

SHA256
26bec6114e67239a103b0c33fef33c802a77703a71ef3a204222454b994dbcf4

SHA512
b19427131293e4548128cfc44bb3d4bd7bfb8dcee552bbd5e5f3173a6786691b49113bb4112f6c2c5ccbf9f0a88977c96c3adb966cbbf73db46af8da2a8c92bb

Download Submit
\Windows\Installer\MSI4D07.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSI4E40.tmp
MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
\Windows\Installer\MSI568C.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
\Windows\Installer\MSI58BE.tmp
MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
\Windows\Installer\MSI58FE.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
\Windows\Installer\MSI5BEC.tmp
MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
\Windows\SysWOW64\FM20ENU.DLL
MD5
361d4d77411d2fba1de48c9a6b913cac

SHA1
9f5dfc5a81ab9343b21bf9d88e6d718eaca8a3e4

SHA256
a9116d4f12c9a8d8bf7bb66221c3ba44ff5d0413e10922e8255bf5e687c1d7fa

SHA512
dc03181a9b7147f0ff357f754055a9e74cecd58e9d79c55765417e9533475b93697af34a080b8db4d066198552ab639178591c4cabe427324e979d2d03e54aff

Download Submit
\Windows\SysWOW64\FM20ENU.DLL
MD5
361d4d77411d2fba1de48c9a6b913cac

SHA1
9f5dfc5a81ab9343b21bf9d88e6d718eaca8a3e4

SHA256
a9116d4f12c9a8d8bf7bb66221c3ba44ff5d0413e10922e8255bf5e687c1d7fa

SHA512
dc03181a9b7147f0ff357f754055a9e74cecd58e9d79c55765417e9533475b93697af34a080b8db4d066198552ab639178591c4cabe427324e979d2d03e54aff

Download Submit
memory/300-77-0x0000000000000000-mapping.dmp

Download
memory/1080-57-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download
memory/1080-56-0x0000000000000000-mapping.dmp

Download
memory/1272-157-0x0000000000000000-mapping.dmp

Download
memory/1316-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1316-55-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/1316-52-0x0000000072641000-0x0000000072644000-memory.dmp

Filesize
12KB

Download
memory/1316-53-0x00000000700C1000-0x00000000700C3000-memory.dmp

Filesize
8KB

Download
memory/1504-159-0x0000000000000000-mapping.dmp

Download
memory/1552-67-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1552-68-0x00000000004028D8-mapping.dmp

Download
memory/1552-72-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1616-63-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1616-60-0x0000000000000000-mapping.dmp

Download
memory/1616-65-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/2028-211-0x0000000000000000-mapping.dmp

Download
memory/2092-227-0x0000000000000000-mapping.dmp

Download
memory/2132-207-0x0000000000000000-mapping.dmp

Download
memory/2132-177-0x0000000000000000-mapping.dmp

Download
memory/2144-233-0x0000000000000000-mapping.dmp

Download
memory/2176-153-0x0000000000000000-mapping.dmp

Download
memory/2192-183-0x0000000000000000-mapping.dmp

Download
memory/2244-205-0x0000000000000000-mapping.dmp

Download
memory/2248-155-0x0000000000000000-mapping.dmp

Download
memory/2264-235-0x0000000000000000-mapping.dmp

Download
memory/2316-181-0x0000000000000000-mapping.dmp

Download
memory/2360-185-0x0000000000000000-mapping.dmp

Download
memory/2364-137-0x0000000000000000-mapping.dmp

Download
memory/2380-189-0x0000000000000000-mapping.dmp

Download
memory/2388-163-0x0000000000000000-mapping.dmp

Download
memory/2424-209-0x0000000000000000-mapping.dmp

Download
memory/2428-237-0x0000000000000000-mapping.dmp

Download
memory/2464-161-0x0000000000000000-mapping.dmp

Download
memory/2476-187-0x0000000000000000-mapping.dmp

Download
memory/2480-215-0x0000000000000000-mapping.dmp

Download
memory/2484-239-0x0000000000000000-mapping.dmp

Download
memory/2504-243-0x0000000000000000-mapping.dmp

Download
memory/2512-139-0x0000000000000000-mapping.dmp

Download
memory/2532-241-0x0000000000000000-mapping.dmp

Download
memory/2540-213-0x0000000000000000-mapping.dmp

Download
memory/2556-165-0x0000000000000000-mapping.dmp

Download
memory/2560-247-0x0000000000000000-mapping.dmp

Download
memory/2580-141-0x0000000000000000-mapping.dmp

Download
memory/2584-171-0x0000000000000000-mapping.dmp

Download
memory/2624-245-0x0000000000000000-mapping.dmp

Download
memory/2628-167-0x0000000000000000-mapping.dmp

Download
memory/2648-191-0x0000000000000000-mapping.dmp

Download
memory/2656-143-0x0000000000000000-mapping.dmp

Download
memory/2660-197-0x0000000000000000-mapping.dmp

Download
memory/2688-219-0x0000000000000000-mapping.dmp

Download
memory/2712-217-0x0000000000000000-mapping.dmp

Download
memory/2716-193-0x0000000000000000-mapping.dmp

Download
memory/2724-221-0x0000000000000000-mapping.dmp

Download
memory/2732-249-0x0000000000000000-mapping.dmp

Download
memory/2736-169-0x0000000000000000-mapping.dmp

Download
memory/2780-195-0x0000000000000000-mapping.dmp

Download
memory/2788-145-0x0000000000000000-mapping.dmp

Download
memory/2816-223-0x0000000000000000-mapping.dmp

Download
memory/2844-225-0x0000000000000000-mapping.dmp

Download
memory/2860-147-0x0000000000000000-mapping.dmp

Download
memory/2896-175-0x0000000000000000-mapping.dmp

Download
memory/2920-201-0x0000000000000000-mapping.dmp

Download
memory/2924-173-0x0000000000000000-mapping.dmp

Download
memory/2976-229-0x0000000000000000-mapping.dmp

Download
memory/2988-149-0x0000000000000000-mapping.dmp

Download
memory/2992-179-0x0000000000000000-mapping.dmp

Download
memory/3000-199-0x0000000000000000-mapping.dmp

Download
memory/3024-231-0x0000000000000000-mapping.dmp

Download
memory/3060-151-0x0000000000000000-mapping.dmp

Download
memory/3060-203-0x0000000000000000-mapping.dmp

Download