072424c82f942f2b43b68b9154e1f3e0c61b7ee39a08372048ed34e09bd2554a

Analysis

max time kernel
229s
max time network
243s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2022 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wlsetup-all.exe
Size

131.0MB
MD5

906689a666d3d9ab4cc951ed6354d0b1
SHA1

14e848bd6b69c4c94c65dd87c1cf70bf8f00992d
SHA256

072424c82f942f2b43b68b9154e1f3e0c61b7ee39a08372048ed34e09bd2554a
SHA512

acc63586c9ef81fceb20ada7ecedd9db390ab7273060e50079e03296e13aab6944140fcd186c4f1263ec497ba1e79100079800718a0911c8f50a7aacf508353a

Score

10^/10

microsoft persistence phishing

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 1288 created 2252 1288 svchost.exe wlsetup-all.exe

description	pid	process	target process
PID 1288 created 2252	1288	svchost.exe	wlsetup-all.exe

Executes dropped EXE 46 IoCs

Processes:

1qim7x4o.exehdfmmkw5.exe8wssakso.exe0h21xh6y.exe1669b4cm.exeqpru1mdw.exehcu8u26f.exeqnvzc2ak.exe0ntx5wrk.exey0warmcy.exe7zd37mcb.exe9mhg3y49.exeqsww60kk.exe4hf0naqm.exehv9h1klo.exe2vjnsfyz.exeo3ahiya6.exezb6qyfl2.exeq5kcitfw.exem3y7qr3i.exeiqlrtlgp.exe7m26c7wd.exedpo3qjxp.exe5lpa4v1k.exedqstzwm1.exedrtm5p1j.exeukdfm9qd.exeDXSETUP.exe4o2c6ylw.exehs6vv67u.exeeg7qse6o.exeh127hxmq.exebmwt63mm.exeb5hyya0r.exetq0mwqgl.exeinfinst.exeDXSETUP.exeinfinst.exeDXSETUP.exeinfinst.exeinfinst.exeinfinst.exeMSI6F21.tmpmsnmsgr.exewlstartup.exewlarp.exe

pid	process
3712	1qim7x4o.exe
3148	hdfmmkw5.exe
4508	8wssakso.exe
4112	0h21xh6y.exe
1092	1669b4cm.exe
3540	qpru1mdw.exe
4328	hcu8u26f.exe
944	qnvzc2ak.exe
4476	0ntx5wrk.exe
2812	y0warmcy.exe
1716	7zd37mcb.exe
1544	9mhg3y49.exe
2580	qsww60kk.exe
4228	4hf0naqm.exe
520	hv9h1klo.exe
4260	2vjnsfyz.exe
2088	o3ahiya6.exe
4932	zb6qyfl2.exe
1200	q5kcitfw.exe
4344	m3y7qr3i.exe
3152	iqlrtlgp.exe
5060	7m26c7wd.exe
2948	dpo3qjxp.exe
2732	5lpa4v1k.exe
3552	dqstzwm1.exe
3516	drtm5p1j.exe
3188	ukdfm9qd.exe
4980	DXSETUP.exe
5080	4o2c6ylw.exe
4564	hs6vv67u.exe
3256	eg7qse6o.exe
760	h127hxmq.exe
2812	bmwt63mm.exe
3856	b5hyya0r.exe
4036	tq0mwqgl.exe
4360	infinst.exe
1884	DXSETUP.exe
3412	infinst.exe
4280	DXSETUP.exe
2544	infinst.exe
4824	infinst.exe
3592	infinst.exe
4488	MSI6F21.tmp
856	msnmsgr.exe
1560	wlstartup.exe
2204	wlarp.exe

Registers COM server for autorun 1 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

msiexec.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DFA66FF-1EE1-4BAF-A034-0023FB7372EB}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4DE8551-2C38-4D43-AD16-674CE04A2081}\InprocServer32\InprocServer32 = 4c007700480075002e00300037006b005a003f00630041002b0077006d002d005a005400410061003c0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F3E06854-6A6D-46F3-B5FA-7BC919BD6302}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3E06854-6A6D-46F3-B5FA-7BC919BD6302}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{58FC39EB-9DBD-4EA7-B7B4-9404CC6ACFAB}\LocalServer32\ = "C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\DWTRIG20.EXE -s"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F4DE8551-2C38-4D43-AD16-674CE04A2081}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F33137-EE26-412F-8D71-F84E4C2C6625}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\PhotoViewerShimx64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4DE8551-2C38-4D43-AD16-674CE04A2081}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F30F90-3E96-453B-AFCD-D71989ECC2C7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F30F90-3E96-453B-AFCD-D71989ECC2C7}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\PhotoViewerShimx64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F33137-EE26-412F-8D71-F84E4C2C6625}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DFA66FF-1EE1-4BAF-A034-0023FB7372EB}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Writer\\WindowsLiveWriter.Filter_x64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32\ = "C:\\Windows\\system32\\XAudio2_7.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cac1105f-619b-4d04-831a-44e1cbf12d57}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4DE8551-2C38-4D43-AD16-674CE04A2081}\InprocServer32\ = "C:\\Program Files\\Windows Live\\Mail\\wlmimefilter64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\PhotoViewerShimx64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3E06854-6A6D-46F3-B5FA-7BC919BD6302}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Writer\\WindowsLiveWriter.Filter_x64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4DFA66FF-1EE1-4BAF-A034-0023FB7372EB}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5a508685-a254-4fba-9b82-9a24b00306af}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F30F90-3E96-453B-AFCD-D71989ECC2C7}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F33137-EE26-412F-8D71-F84E4C2C6625}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F346CB-35A4-465B-8B8F-65A29DBAB1F6}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{58FC39EB-9DBD-4EA7-B7B4-9404CC6ACFAB}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4DE8551-2C38-4D43-AD16-674CE04A2081}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F346CB-35A4-465B-8B8F-65A29DBAB1F6}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F346CB-35A4-465B-8B8F-65A29DBAB1F6}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\PhotoViewerShimx64.dll"	msiexec.exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLXAlbumDownloadWizard.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLXAlbumDownloadWizard.exe\CWDIllegalInDllSearch = "4294967295"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MovieMaker.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MovieMaker.exe\CWDIllegalInDllSearch = "4294967295"	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wlstartup.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	wlstartup.exe

Loads dropped DLL 64 IoCs

Processes:

DXSETUP.exeDXSETUP.exeDXSETUP.exeregsvr32.exeMsiExec.exeMsiExec.exeMsiExec.exemsnmsgr.exewlstartup.exe

pid	process
4980	DXSETUP.exe
4980	DXSETUP.exe
4980	DXSETUP.exe
4980	DXSETUP.exe
1884	DXSETUP.exe
1884	DXSETUP.exe
1884	DXSETUP.exe
1884	DXSETUP.exe
4280	DXSETUP.exe
4280	DXSETUP.exe
4280	DXSETUP.exe
4280	DXSETUP.exe
4280	DXSETUP.exe
4260	regsvr32.exe
4824	MsiExec.exe
3552	MsiExec.exe
3552	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4744	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4744	MsiExec.exe
4824	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4744	MsiExec.exe
4744	MsiExec.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
856	msnmsgr.exe
1560	wlstartup.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 39 IoCs

Processes:

infinst.exeDXSETUP.exeDXSETUP.exeinfinst.exeDXSETUP.exeinfinst.exeinfinst.exeinfinst.exemsiexec.exe

description	ioc	process
File created	C:\Windows\system32\SETE8E9.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx9_32.dll	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETE271.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETE88B.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETE8BA.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETDB5C.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETDC08.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETE8BB.tmp	DXSETUP.exe
File created	C:\Windows\system32\SETE8F9.tmp	infinst.exe
File created	C:\Windows\SysWOW64\SETDB5C.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETE271.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SETE8BA.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETE8E9.tmp	infinst.exe
File created	C:\Windows\system32\SETE88B.tmp	infinst.exe
File opened for modification	C:\Windows\system32\XAudio2_7.dll	infinst.exe
File created	C:\Windows\system32\SETDC08.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx10_42.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETE7B0.tmp	DXSETUP.exe
File opened for modification	C:\Windows\system32\SETE7FE.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\XAPOFX1_5.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\XAPOFX1_5.dll	infinst.exe
File opened for modification	C:\Windows\system32\SETE8F9.tmp	infinst.exe
File opened for modification	C:\Windows\system32\d3dx9_32.dll	infinst.exe
File opened for modification	C:\Windows\system32\d3dx10_42.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETE84D.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\XAudio2_7.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SETE8BB.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\sirenacm.dll	msiexec.exe
File opened for modification	C:\Windows\system32\SETE2FD.tmp	infinst.exe
File opened for modification	C:\Windows\system32\d3dx11_43.dll	infinst.exe
File opened for modification	C:\Windows\SysWOW64\SETE84D.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe
File created	C:\Windows\system32\SETE2FD.tmp	infinst.exe
File opened for modification	C:\Windows\SysWOW64\d3dx11_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\system32\D3DCompiler_43.dll	infinst.exe
File created	C:\Windows\SysWOW64\SETE7B0.tmp	DXSETUP.exe
File created	C:\Windows\system32\SETE7FE.tmp	infinst.exe
File created	C:\Windows\SysWOW64\D3DCompiler_41.dll	msiexec.exe
File created	C:\Windows\SysWOW64\d3dx10_41.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exewlsetup-all.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\DissolveTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectZoomInFullToTopRightTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Messenger\uccapires.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\RollTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Mail\wlmfilter.dat	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\CinematicOverlayRightHighEffectTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\TranscodeConfig.xml	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Mail\mailacct.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectAutomaticTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectZoomInFullToLeftMiddleTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\en\WLFlickrPlugin.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Messenger\vvpltfrm.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\bcb2a371d8ab751b\WLXSuiteLang.msi	wlsetup-all.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\c57d8ab1d8ab751d\MessengerLang.msi	wlsetup-all.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\wlxclip.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\ContemporaryFade2TextScript.wlms	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PosterizeEffectTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\f74c20021d8ab7404\dsetup32.dll	wlsetup-all.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectZoomOutBottomRightToFullTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\TextEffectSpinOutTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Installer\en\wlsres.dll.mui	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\f5e8e2051d8ab7402\DSETUP.dll	wlsetup-all.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\DiagonalCrossOutTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\f74c20021d8ab7404\DXSETUP.exe	wlsetup-all.exe
File created	C:\Program Files (x86)\Windows Live\Installer\wlsres.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\en\WLXAlbumDownloadWizardResources.dll.mui	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\f504003e1d8ab7401\DXSETUP.exe	wlsetup-all.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.1\sqlceca30.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\ExtentSelectorTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriter.Application.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\WipeNormalRightTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriter.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\SlideDownTogetherTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Writer\WindowsLiveLocal.WriterPlugin.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShimx64.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\CrossFadeTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\DefaultThemeScript.wlms	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectZoomInFullToRightMiddleTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\SepiaThemeScript.wlms	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\TextEffectCinematicCaption2LeftTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Writer\html\loading.png	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\en\MovieMakerLang.dll.mui	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Shared\WLMFDS.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Messenger\psmsong.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\MirrorVerticalEffectTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\e966b531d8ab7521\writerprodlang.msi	wlsetup-all.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoBase.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Mail\wlmfilter.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\KeyholeTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\MirrorHorizontalEffectTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\SpinInTextScript.wlms	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\f504003e1d8ab7401\DEC2006_d3dx9_32_x64.cab	wlsetup-all.exe
File created	C:\Program Files (x86)\Windows Live\Mail\wcics.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectZoomInFullToTopMiddleTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PixelateTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoSqm.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\CircleTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\BowTieHorizontalTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Installer\defmgr.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Writer\WindowsLive.Writer.HtmlEditor.dll	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PageCurlDownRightTransitionTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectPanBottomToTopAlongMiddleTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMakerTemplates\PanAndZoomEffectPanLeftToRightAlongBottomTemplate.wlmx	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Windows Live\.cache\f5e8e2051d8ab7402\Jun2010_XAudio_x64.cab	wlsetup-all.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exeMSI6F21.tmpDXSETUP.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{07AAB66E-4718-422D-9218-4AFB3C922A71}	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20220808222039747.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\F187AF9E08E3993428A5DAE3112CC877\16.4.1109\F_CENTRAL_msvcp110_x64.4006A2C6_1BD5_3759_9C0C_17A8FFBF6E3C	msiexec.exe
File created	C:\Windows\Installer\e57ec32.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5137.tmp	msiexec.exe
File created	C:\Windows\assembly\tmp\GTTVC1D0\System.Data.SqlServerCe.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F21.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20220808222039653.0\msvcp90.dll	msiexec.exe
File created	C:\Windows\Installer\e57ec24.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec39.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec45.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BAD27F0E-5165-49A5-BE66-AF5BF73F2FEE}	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20220808222049075.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D1893000-EA77-493C-8DDD-E262436E959B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI532F.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ec47.msi	msiexec.exe
File created	C:\Windows\Installer\e57ec66.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8CDD41E806AE81E43B3E917301D4B5AD\16.4.1108\F_CENTRAL_msvcr110_x86.F9D0B380_EB85_31D4_96AC_C6CB40086A55	msiexec.exe
File created	C:\Windows\Installer\e57ec41.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\machine.config	MSI6F21.tmp
File opened for modification	C:\Windows\Installer\MSI73E5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec2a.msi	msiexec.exe
File created	C:\Windows\Installer\e57ec54.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec6f.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20220808222049012.0	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI597A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B64.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ec1d.msi	msiexec.exe
File created	C:\Windows\Installer\e57ec30.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec48.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI65C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec60.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\8CDD41E806AE81E43B3E917301D4B5AD\16.4.1108\F_CENTRAL_vccorlib110_x86.F9D0B380_EB85_31D4_96AC_C6CB40086A55	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20220808222049075.1\9.0.30729.4148.policy	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3527.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B775C26B-EAA8-4A11-ACBF-76E52DF6B805}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA4C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e57ec42.msi	msiexec.exe
File created	C:\Windows\Installer\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec6c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEE09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AD9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI50D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Installer\e57ec3f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6BA4.tmp	msiexec.exe
File created	C:\Windows\Installer\e57ec23.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20220808222053059.0\amd64_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3fea50ad.cat	msiexec.exe
File created	C:\Windows\Installer\SourceHash{00F9DB8C-65D7-4D47-AB5F-F698EE38580D}	msiexec.exe
File created	C:\Windows\Installer\e57ec3c.msi	msiexec.exe
File created	C:\Windows\Installer\{E703613B-BDAB-433E-A66A-DE0263E3D35D}\MsblIco.Exe	msiexec.exe
File created	C:\Windows\Installer\e57ec4a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec18.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2DC527D-FA79-46E9-973F-920897CA55E9}	msiexec.exe
File created	C:\Windows\Installer\e57ec17.msi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20220808222049075.0\9.0.30729.4148.cat	msiexec.exe
File opened for modification	C:\Windows\Installer\e57ec42.msi	msiexec.exe
File created	C:\Windows\Installer\e57ec4e.msi	msiexec.exe
File created	C:\Windows\Installer\{04BE4035-3C8E-4B48-BFB8-1655849C0C8B}\ApplicationIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA957.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20220808222039653.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000052a0c1bba5f234a60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000052a0c1bb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090052a0c1bb000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000052a0c1bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000052a0c1bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msnmsgr.exewlstartup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msnmsgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msnmsgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wlstartup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wlstartup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msnmsgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msnmsgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4288 schtasks.exe

pid	process
4288	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exewlstartup.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d8a5d001-3352-40db-9d1c-ed46683193b5}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{43ABBB95-C0E9-497B-8BB9-B5FA08861705}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D133B285-8A43-4EC7-93BE-9B909C2370F5}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{25914AE5-2F57-40a5-A804-966F1E4959A3}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\msnmsgr.exe = "6"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}\ClsidExtension = "{5F7B1267-94A9-47F5-98DB-E99415F33AEC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d8a5d001-3352-40db-9d1c-ed46683193b5}\AppName = "WindowsLiveWriter.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9019d14b-638d-4383-bb95-441b7f57eafb}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DB9524B3-24F4-48fa-91C5-B8EEF1C0A14F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}\HotIcon = "C:\\Program Files (x86)\\Windows Live\\Writer\\WriterBrowserExtension.dll,201"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F4C30BB5-D7FC-4d60-9D49-7C6B67C3592D}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{43ABBB95-C0E9-497B-8BB9-B5FA08861705}\AppPath = "C:\\Program Files (x86)\\Windows Live\\Mail\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6FBF8DD5-9E03-4af5-B779-FEBEF6754712}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0D81DFEC-5610-4a2b-9B57-FC33D21366F0}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9019d14b-638d-4383-bb95-441b7f57eafb}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{323C0F99-820A-4e0b-B714-57942C6D9678}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{111C85E9-BB62-4528-A806-F0BE908E02F0}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d8a5d001-3352-40db-9d1c-ed46683193b5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{323C0F99-820A-4e0b-B714-57942C6D9678}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0D81DFEC-5610-4a2b-9B57-FC33D21366F0}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d8a5d001-3352-40db-9d1c-ed46683193b5}\AppPath = "C:\\Program Files (x86)\\Windows Live\\Writer\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{380689D0-AFAA-47E6-B80E-A33436FE314B}\AppName = "wlcomm.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{380689D0-AFAA-47E6-B80E-A33436FE314B}\AppPath = "C:\\Program Files (x86)\\Windows Live\\Contacts\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BEHAVIORS\wlmail.exe = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING\wlmail.exe = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Version Vector\WLPG = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}\Icon = "C:\\Program Files (x86)\\Windows Live\\Writer\\WriterBrowserExtension.dll,201"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}\Default Visible = "Yes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9019d14b-638d-4383-bb95-441b7f57eafb}\AppName = "wlstartup.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SUBDOWNLOAD_LOCKDOWN	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}\ButtonText = "@C:\\Program Files (x86)\\Windows Live\\Writer\\WindowsLiveWriterShortcuts.dll,-1004"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D133B285-8A43-4EC7-93BE-9B909C2370F5}\AppPath = "C:\\Program Files (x86)\\Windows Live\\Messenger\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{380689D0-AFAA-47E6-B80E-A33436FE314B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{380689D0-AFAA-47E6-B80E-A33436FE314B}\ = "Windows Live Contact Database"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F5F545A6-39C4-40b5-814D-B45040A89FB5}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{43ABBB95-C0E9-497B-8BB9-B5FA08861705}\AppName = "wlmail.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SUBDOWNLOAD_LOCKDOWN\wlmail.exe = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_OBJECT_DATA_ATTRIBUTE	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Extensions\{219C3416-8CB2-491a-A3C7-D9FCDDC9D600}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9019d14b-638d-4383-bb95-441b7f57eafb}\AppPath = "C:\\Program Files (x86)\\Windows Live\\Installer\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	wlstartup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F4C30BB5-D7FC-4d60-9D49-7C6B67C3592D}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\wlmail.exe = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\wlmail.exe = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Software\Microsoft\Internet Explorer\GPU	wlstartup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F5F545A6-39C4-40b5-814D-B45040A89FB5}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{25914AE5-2F57-40a5-A804-966F1E4959A3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D133B285-8A43-4EC7-93BE-9B909C2370F5}\AppName = "msnmsgr.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING\wlmail.exe = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\wlmail.exe = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\wlmail.exe = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_OBJECT_DATA_ATTRIBUTE\wlmail.exe = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_OBJECT_DATA_ATTRIBUTE\WindowsLiveWriter.exe = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{111C85E9-BB62-4528-A806-F0BE908E02F0}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F81CD990-910B-4bbf-9CB3-6A77F3D697B3}\Compatibility Flags = "1024"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

msiexec.exeMsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\35	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\32	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Clients\Mail	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\32	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\35	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Clients	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\38	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\37	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Clients\Mail	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeDXSETUP.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5FA3C27-EA68-4A02-AC07-7C64D64B6E7F}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9F5F2256B11431547AB5EC0A30590F23\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6a93130e-1d53-41d1-a9cf-e758800bb179}\InProcServer32\ = "C:\\Windows\\SysWow64\\XAudio2_7.dll"	DXSETUP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0003981D77AEC394D8DD2E2634E659B9\SourceList\Media\DiskPrompt = "Windows Live SOXE Definitions"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{380689D0-AFAA-47E6-B80E-A33436FE314B}\AppID = "{380689D0-AFAA-47E6-B80E-A33436FE314B}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5FA3C32-EA68-4A02-AC07-7C64D64B6E7F}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{380689D0-AFAA-47E6-B80E-A33436FE314B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSNMessenger.Hotmail3Control.1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6052547-991B-422D-A33A-3C8640B15B8C}\ProxyStubClsid32\ = "{9F12887B-A514-46d2-B9EB-B1DCD77CB39A}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{4D8A134F-3D0A-4375-8B1A-78CD171C9318}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9C0117DA-D42A-4E43-92A9-C3D0ADD63BFE}\NumMethods\ = "4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF4B4853-6A83-4EB8-BDBC-3890889753AA}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{34CD8C45-56A0-4200-933F-38035ED7F7FC}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5FA3C12-EA68-4A02-AC07-7C64D64B6E7F}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C}\ = "Windows Live Photo Gallery Editor Drop Target"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F3E06854-6A6D-46F3-B5FA-7BC919BD6302}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ptx\OpenWithList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00F33137-EE26-412F-8D71-F84E4C2C6625}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\PhotoViewerShim.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96530F83636A3FC4DBED30C2C8523140\PackageCode = "9803045A7D5BAB546B8AAF2C1A6C2D7F"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F88B2D4C-1027-4409-8363-21487644A335}\NumMethods\ = "7"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WindowsLiveMail.VCard.1\DefaultIcon\ = "C:\\Program Files (x86)\\Windows Live\\Mail\\maillang.dll,-23382"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDE41C5F-EB7D-4c3d-8C9C-12D8F68B24D9}\ProgID\ = "SSCE.Params.3.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.LivePhotoAcquire\CurVer\ = "Microsoft.LivePhotoAcquire.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.dvr-ms\OpenWithProgIds	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Typelib\{6F1D1C70-4B8A-4273-808E-5FB78E797702}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E82C237-D138-4199-936F-A0711BCB2243}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F69DC877-D0E4-475C-942D-60D58E7B16B9}\ = "Classic Slideshow Theme Black and White"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{2ACDA88A-59CA-4A6E-BE5D-67675D3967CE}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC46E1E4-9981-49E8-A5E1-90A07142EDC3}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E32CD0C4-C740-42AF-96A9-9B0C113BA398}\VersionIndependentProgID\ = "Microsoft.Photos.LiveViewerGalleryInterface"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\12385052E33CB6949851F66DD463C2FA\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A5FA3C27-EA68-4A02-AC07-7C64D64B6E7F}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{81C55BCB-3490-436A-9F94-A264C15BFC54}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSNMessenger.HotmailControl\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A06D7A1A-6BFD-49F8-BCE8-D476B3BC8931}\ProxyStubClsid32\ = "{81C55BCB-3490-436A-9F94-A264C15BFC54}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D6B0E4C8-FAD6-4885-B271-0DC5A584ADF8}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WLPG\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WindowsLive.PhotoGallery.jpg.16.4\FriendlyTypeName = "@%ProgramFiles(x86)%\\Windows Live\\Photo Gallery\\regres.dll,-3070"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{795634D5-6F56-495F-A6EC-B4A462B3BD87}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1709DC81-FC07-425E-916F-671AD025A4EC}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{305D86C6-6896-4099-91F5-CB7BA7733563}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WindowsLive.PhotoGallery.ico.16.4\shellex\{e357fccd-a995-4576-b01f-234630154e96}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00F346CB-35A4-465B-8B8F-65A29DBAB1F6}\InprocServer32\ = "C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\PhotoViewerShim.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.jpeg\OpenWithList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5304EB40E8C384B4FB8B615548C9C0B8\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{58FC39EB-9DBD-4EA7-B7B4-9404CC6ACFAB}\RunAs = "Interactive User"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\80316C14DFC645D4BAA61763DE801AE8\PackageCode = "BD51A9A0D14510E4098419BB148457B7"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{31935372-7052-404a-AA4D-59496A1AF9B3}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WindowsLive.PhotoGallery.jpg.16.4\shell\preview	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Microsoft.Photos.LiveSlideshow.CinematicFullScreen1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ptx\OpenWithProgIds\WindowsLive.PhotoGallery.raw.16.4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4DFA66FF-1EE1-4BAF-A034-0023FB7372EB}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PROTOCOLS\Handler\msnim	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Microsoft.LivePhotoAcqDeviceSelectionDlg.1	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{483A53CD-EF18-4B19-8AA3-2E2E3214EB41}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8DEDF9E-4D73-40E9-A064-0682F7F9193F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Photos.LiveSlideshow.ClassicThemeBW.1\ = "Classic Slideshow Theme Black and White"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06A2568A-CED6-4187-BB20-400B8C02BE5A}\LocalServer32\ = "C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\WLXPhotoAcquireWizard.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\SystemFileAssociations\.dcr\OpenWithList\WLXPhotoViewer.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00F33137-EE26-412F-8D71-F84E4C2C6625}\ = "Windows Live Photo Gallery Viewer Autoplay Shim"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A0F97DCA-FFA8-48DE-AB20-7782040C67A9}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{BAA27BAB-E1BF-47F5-8689-93C45A2EC0F7}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{600FA340-4E2D-4C85-989D-5CA19A41D121}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FAE79C9-BA02-43D9-9382-C7BEF740A596}\ = "CAviTocParser"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

wlsetup-all.exeMsiExec.exe

pid	process
2252	wlsetup-all.exe
2252	wlsetup-all.exe
2252	wlsetup-all.exe
2252	wlsetup-all.exe
2252	wlsetup-all.exe
2252	wlsetup-all.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
4824	MsiExec.exe
2252	wlsetup-all.exe
2252	wlsetup-all.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exesrtasks.exewlsetup-all.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	4700	vssvc.exe
Token: SeRestorePrivilege	4700	vssvc.exe
Token: SeAuditPrivilege	4700	vssvc.exe
Token: SeBackupPrivilege	3952	srtasks.exe
Token: SeRestorePrivilege	3952	srtasks.exe
Token: SeSecurityPrivilege	3952	srtasks.exe
Token: SeTakeOwnershipPrivilege	3952	srtasks.exe
Token: SeBackupPrivilege	3952	srtasks.exe
Token: SeRestorePrivilege	3952	srtasks.exe
Token: SeSecurityPrivilege	3952	srtasks.exe
Token: SeTakeOwnershipPrivilege	3952	srtasks.exe
Token: SeShutdownPrivilege	2252	wlsetup-all.exe
Token: SeIncreaseQuotaPrivilege	2252	wlsetup-all.exe
Token: SeSecurityPrivilege	4536	msiexec.exe
Token: SeCreateTokenPrivilege	2252	wlsetup-all.exe
Token: SeAssignPrimaryTokenPrivilege	2252	wlsetup-all.exe
Token: SeLockMemoryPrivilege	2252	wlsetup-all.exe
Token: SeIncreaseQuotaPrivilege	2252	wlsetup-all.exe
Token: SeMachineAccountPrivilege	2252	wlsetup-all.exe
Token: SeTcbPrivilege	2252	wlsetup-all.exe
Token: SeSecurityPrivilege	2252	wlsetup-all.exe
Token: SeTakeOwnershipPrivilege	2252	wlsetup-all.exe
Token: SeLoadDriverPrivilege	2252	wlsetup-all.exe
Token: SeSystemProfilePrivilege	2252	wlsetup-all.exe
Token: SeSystemtimePrivilege	2252	wlsetup-all.exe
Token: SeProfSingleProcessPrivilege	2252	wlsetup-all.exe
Token: SeIncBasePriorityPrivilege	2252	wlsetup-all.exe
Token: SeCreatePagefilePrivilege	2252	wlsetup-all.exe
Token: SeCreatePermanentPrivilege	2252	wlsetup-all.exe
Token: SeBackupPrivilege	2252	wlsetup-all.exe
Token: SeRestorePrivilege	2252	wlsetup-all.exe
Token: SeShutdownPrivilege	2252	wlsetup-all.exe
Token: SeDebugPrivilege	2252	wlsetup-all.exe
Token: SeAuditPrivilege	2252	wlsetup-all.exe
Token: SeSystemEnvironmentPrivilege	2252	wlsetup-all.exe
Token: SeChangeNotifyPrivilege	2252	wlsetup-all.exe
Token: SeRemoteShutdownPrivilege	2252	wlsetup-all.exe
Token: SeUndockPrivilege	2252	wlsetup-all.exe
Token: SeSyncAgentPrivilege	2252	wlsetup-all.exe
Token: SeEnableDelegationPrivilege	2252	wlsetup-all.exe
Token: SeManageVolumePrivilege	2252	wlsetup-all.exe
Token: SeImpersonatePrivilege	2252	wlsetup-all.exe
Token: SeCreateGlobalPrivilege	2252	wlsetup-all.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe
Token: SeTakeOwnershipPrivilege	4536	msiexec.exe
Token: SeRestorePrivilege	4536	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

wlsetup-all.exemsnmsgr.exewlstartup.exe

pid process

2252 wlsetup-all.exe
856 msnmsgr.exe
1560 wlstartup.exe
856 msnmsgr.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

msnmsgr.exe

pid process

856 msnmsgr.exe
856 msnmsgr.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

wlstartup.exemsnmsgr.exe

pid process

1560 wlstartup.exe
1560 wlstartup.exe
1560 wlstartup.exe
1560 wlstartup.exe
856 msnmsgr.exe
856 msnmsgr.exe

pid	process
856	msnmsgr.exe
856	msnmsgr.exe

pid	process
1560	wlstartup.exe
1560	wlstartup.exe
1560	wlstartup.exe
1560	wlstartup.exe
856	msnmsgr.exe
856	msnmsgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wlsetup-all.exe

description	pid	process	target process
PID 2252 wrote to memory of 3712	2252	wlsetup-all.exe	1qim7x4o.exe
PID 2252 wrote to memory of 3712	2252	wlsetup-all.exe	1qim7x4o.exe
PID 2252 wrote to memory of 3712	2252	wlsetup-all.exe	1qim7x4o.exe
PID 2252 wrote to memory of 3148	2252	wlsetup-all.exe	hdfmmkw5.exe
PID 2252 wrote to memory of 3148	2252	wlsetup-all.exe	hdfmmkw5.exe
PID 2252 wrote to memory of 3148	2252	wlsetup-all.exe	hdfmmkw5.exe
PID 2252 wrote to memory of 4508	2252	wlsetup-all.exe	8wssakso.exe
PID 2252 wrote to memory of 4508	2252	wlsetup-all.exe	8wssakso.exe
PID 2252 wrote to memory of 4508	2252	wlsetup-all.exe	8wssakso.exe
PID 2252 wrote to memory of 4112	2252	wlsetup-all.exe	0h21xh6y.exe
PID 2252 wrote to memory of 4112	2252	wlsetup-all.exe	0h21xh6y.exe
PID 2252 wrote to memory of 4112	2252	wlsetup-all.exe	0h21xh6y.exe
PID 2252 wrote to memory of 1092	2252	wlsetup-all.exe	1669b4cm.exe
PID 2252 wrote to memory of 1092	2252	wlsetup-all.exe	1669b4cm.exe
PID 2252 wrote to memory of 1092	2252	wlsetup-all.exe	1669b4cm.exe
PID 2252 wrote to memory of 3540	2252	wlsetup-all.exe	qpru1mdw.exe
PID 2252 wrote to memory of 3540	2252	wlsetup-all.exe	qpru1mdw.exe
PID 2252 wrote to memory of 3540	2252	wlsetup-all.exe	qpru1mdw.exe
PID 2252 wrote to memory of 4328	2252	wlsetup-all.exe	hcu8u26f.exe
PID 2252 wrote to memory of 4328	2252	wlsetup-all.exe	hcu8u26f.exe
PID 2252 wrote to memory of 4328	2252	wlsetup-all.exe	hcu8u26f.exe
PID 2252 wrote to memory of 944	2252	wlsetup-all.exe	qnvzc2ak.exe
PID 2252 wrote to memory of 944	2252	wlsetup-all.exe	qnvzc2ak.exe
PID 2252 wrote to memory of 944	2252	wlsetup-all.exe	qnvzc2ak.exe
PID 2252 wrote to memory of 4476	2252	wlsetup-all.exe	0ntx5wrk.exe
PID 2252 wrote to memory of 4476	2252	wlsetup-all.exe	0ntx5wrk.exe
PID 2252 wrote to memory of 4476	2252	wlsetup-all.exe	0ntx5wrk.exe
PID 2252 wrote to memory of 2812	2252	wlsetup-all.exe	y0warmcy.exe
PID 2252 wrote to memory of 2812	2252	wlsetup-all.exe	y0warmcy.exe
PID 2252 wrote to memory of 2812	2252	wlsetup-all.exe	y0warmcy.exe
PID 2252 wrote to memory of 1716	2252	wlsetup-all.exe	7zd37mcb.exe
PID 2252 wrote to memory of 1716	2252	wlsetup-all.exe	7zd37mcb.exe
PID 2252 wrote to memory of 1716	2252	wlsetup-all.exe	7zd37mcb.exe
PID 2252 wrote to memory of 1544	2252	wlsetup-all.exe	9mhg3y49.exe
PID 2252 wrote to memory of 1544	2252	wlsetup-all.exe	9mhg3y49.exe
PID 2252 wrote to memory of 1544	2252	wlsetup-all.exe	9mhg3y49.exe
PID 2252 wrote to memory of 2580	2252	wlsetup-all.exe	qsww60kk.exe
PID 2252 wrote to memory of 2580	2252	wlsetup-all.exe	qsww60kk.exe
PID 2252 wrote to memory of 2580	2252	wlsetup-all.exe	qsww60kk.exe
PID 2252 wrote to memory of 4228	2252	wlsetup-all.exe	4hf0naqm.exe
PID 2252 wrote to memory of 4228	2252	wlsetup-all.exe	4hf0naqm.exe
PID 2252 wrote to memory of 4228	2252	wlsetup-all.exe	4hf0naqm.exe
PID 2252 wrote to memory of 520	2252	wlsetup-all.exe	hv9h1klo.exe
PID 2252 wrote to memory of 520	2252	wlsetup-all.exe	hv9h1klo.exe
PID 2252 wrote to memory of 520	2252	wlsetup-all.exe	hv9h1klo.exe
PID 2252 wrote to memory of 4260	2252	wlsetup-all.exe	2vjnsfyz.exe
PID 2252 wrote to memory of 4260	2252	wlsetup-all.exe	2vjnsfyz.exe
PID 2252 wrote to memory of 4260	2252	wlsetup-all.exe	2vjnsfyz.exe
PID 2252 wrote to memory of 2088	2252	wlsetup-all.exe	o3ahiya6.exe
PID 2252 wrote to memory of 2088	2252	wlsetup-all.exe	o3ahiya6.exe
PID 2252 wrote to memory of 2088	2252	wlsetup-all.exe	o3ahiya6.exe
PID 2252 wrote to memory of 4932	2252	wlsetup-all.exe	zb6qyfl2.exe
PID 2252 wrote to memory of 4932	2252	wlsetup-all.exe	zb6qyfl2.exe
PID 2252 wrote to memory of 4932	2252	wlsetup-all.exe	zb6qyfl2.exe
PID 2252 wrote to memory of 1200	2252	wlsetup-all.exe	q5kcitfw.exe
PID 2252 wrote to memory of 1200	2252	wlsetup-all.exe	q5kcitfw.exe
PID 2252 wrote to memory of 1200	2252	wlsetup-all.exe	q5kcitfw.exe
PID 2252 wrote to memory of 4344	2252	wlsetup-all.exe	m3y7qr3i.exe
PID 2252 wrote to memory of 4344	2252	wlsetup-all.exe	m3y7qr3i.exe
PID 2252 wrote to memory of 4344	2252	wlsetup-all.exe	m3y7qr3i.exe
PID 2252 wrote to memory of 3152	2252	wlsetup-all.exe	iqlrtlgp.exe
PID 2252 wrote to memory of 3152	2252	wlsetup-all.exe	iqlrtlgp.exe
PID 2252 wrote to memory of 3152	2252	wlsetup-all.exe	iqlrtlgp.exe
PID 2252 wrote to memory of 5060	2252	wlsetup-all.exe	7m26c7wd.exe

C:\Users\Admin\AppData\Local\Temp\wlsetup-all.exe
"C:\Users\Admin\AppData\Local\Temp\wlsetup-all.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2252

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\bhd8odwp\1qim7x4o.exe
1qim7x4o.exe cy2jiye7.tmp
2⤵
- Executes dropped EXE
PID:3712

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\exptl2k6\hdfmmkw5.exe
hdfmmkw5.exe tdc3incq.tmp
2⤵
- Executes dropped EXE
PID:3148

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\6ua6tkxx\8wssakso.exe
8wssakso.exe 4yh9kn9k.tmp
2⤵
- Executes dropped EXE
PID:4508

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\vsoerak2\0h21xh6y.exe
0h21xh6y.exe mn7tquu7.tmp
2⤵
- Executes dropped EXE
PID:4112

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\z116nu89\1669b4cm.exe
1669b4cm.exe ivpgdbah.tmp
2⤵
- Executes dropped EXE
PID:1092

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xg5e9yyj\qpru1mdw.exe
qpru1mdw.exe zj4axyhh.tmp
2⤵
- Executes dropped EXE
PID:3540

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\2xznll6v\hcu8u26f.exe
hcu8u26f.exe 0jr25z2t.tmp
2⤵
- Executes dropped EXE
PID:4328

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lkryf9aw\qnvzc2ak.exe
qnvzc2ak.exe 3nom5dmo.tmp
2⤵
- Executes dropped EXE
PID:944

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\naggfi3y\0ntx5wrk.exe
0ntx5wrk.exe yf6yt24r.tmp
2⤵
- Executes dropped EXE
PID:4476

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lerubtnv\y0warmcy.exe
y0warmcy.exe 4p4605tp.tmp
2⤵
- Executes dropped EXE
PID:2812

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\ebs6orty\7zd37mcb.exe
7zd37mcb.exe dqf5g89t.tmp
2⤵
- Executes dropped EXE
PID:1716

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xe7h3bjm\9mhg3y49.exe
9mhg3y49.exe knc0d756.tmp
2⤵
- Executes dropped EXE
PID:1544

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\581esvnt\qsww60kk.exe
qsww60kk.exe ve4gdnoq.tmp
2⤵
- Executes dropped EXE
PID:2580

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\pu33509z\4hf0naqm.exe
4hf0naqm.exe 1n47mmma.tmp
2⤵
- Executes dropped EXE
PID:4228

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\uohmidja\hv9h1klo.exe
hv9h1klo.exe t0h5pbsh.tmp
2⤵
- Executes dropped EXE
PID:520

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\gi6u5qbq\2vjnsfyz.exe
2vjnsfyz.exe rjl24sm0.tmp
2⤵
- Executes dropped EXE
PID:4260

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\w3efq6fe\o3ahiya6.exe
o3ahiya6.exe cekooi7z.tmp
2⤵
- Executes dropped EXE
PID:2088

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\f0nhpudl\zb6qyfl2.exe
zb6qyfl2.exe 99m94jor.tmp
2⤵
- Executes dropped EXE
PID:4932

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\0ur6k8e7\q5kcitfw.exe
q5kcitfw.exe xnb5jkfy.tmp
2⤵
- Executes dropped EXE
PID:1200

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\kyd97vja\m3y7qr3i.exe
m3y7qr3i.exe pykis5pc.tmp
2⤵
- Executes dropped EXE
PID:4344

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\am52ynei\iqlrtlgp.exe
iqlrtlgp.exe vwo9x0h1.tmp
2⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\mia1xzs3\7m26c7wd.exe
7m26c7wd.exe 7n4ur9yi.tmp
2⤵
- Executes dropped EXE
PID:5060

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\fxbhxk9g\dpo3qjxp.exe
dpo3qjxp.exe ea48dhul.tmp
2⤵
- Executes dropped EXE
PID:2948

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\57epzevp\5lpa4v1k.exe
5lpa4v1k.exe hjseqhot.tmp
2⤵
- Executes dropped EXE
PID:2732

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\oy8rbolm\dqstzwm1.exe
dqstzwm1.exe l210n5mh.tmp
2⤵
- Executes dropped EXE
PID:3552

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\q8okm7es\drtm5p1j.exe
drtm5p1j.exe q57ad3zl.tmp
2⤵
- Executes dropped EXE
PID:3516

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\zskdctcq\ukdfm9qd.exe
ukdfm9qd.exe tmzot45u.tmp
2⤵
- Executes dropped EXE
PID:3188

C:\Program Files (x86)\Common Files\Windows Live\.cache\f504003e1d8ab7401\DXSETUP.exe
"C:\Program Files (x86)\Common Files\Windows Live\.cache\f504003e1d8ab7401\DXSETUP.exe" /silent
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4980

C:\Users\Admin\AppData\Local\Temp\DXD91A.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DXD91A.tmp\infinst.exe d3dx9_32_x64.inf
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4360

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\r0p9gqwj\4o2c6ylw.exe
4o2c6ylw.exe fm8y5vmf.tmp
2⤵
- Executes dropped EXE
PID:5080

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\vaqgcdtr\hs6vv67u.exe
hs6vv67u.exe uyj6tyup.tmp
2⤵
- Executes dropped EXE
PID:4564

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\d6v46j0o\eg7qse6o.exe
eg7qse6o.exe uxd5jcl9.tmp
2⤵
- Executes dropped EXE
PID:3256

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\kligdfxn\h127hxmq.exe
h127hxmq.exe 7c0xjrpd.tmp
2⤵
- Executes dropped EXE
PID:760

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\jqu5wffw\bmwt63mm.exe
bmwt63mm.exe 0rufknwf.tmp
2⤵
- Executes dropped EXE
PID:2812

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\4osvx434\b5hyya0r.exe
b5hyya0r.exe cecwkuqu.tmp
2⤵
- Executes dropped EXE
PID:3856

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\fa3ccxoq\tq0mwqgl.exe
tq0mwqgl.exe o79okj5l.tmp
2⤵
- Executes dropped EXE
PID:4036

C:\Program Files (x86)\Common Files\Windows Live\.cache\f74c20021d8ab7404\DXSETUP.exe
"C:\Program Files (x86)\Common Files\Windows Live\.cache\f74c20021d8ab7404\DXSETUP.exe" /silent
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1884

C:\Users\Admin\AppData\Local\Temp\DXE177.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DXE177.tmp\infinst.exe d3dx10_42_x64.inf
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3412

C:\Program Files (x86)\Common Files\Windows Live\.cache\f5e8e2051d8ab7402\DXSETUP.exe
"C:\Program Files (x86)\Common Files\Windows Live\.cache\f5e8e2051d8ab7402\DXSETUP.exe" /silent
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
PID:4280

C:\Users\Admin\AppData\Local\Temp\DXE659.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DXE659.tmp\infinst.exe d3dx11_43_x64.inf
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2544

C:\Users\Admin\AppData\Local\Temp\DXE659.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DXE659.tmp\infinst.exe D3DCompiler_43_x64.inf
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4824

C:\Users\Admin\AppData\Local\Temp\DXE659.tmp\infinst.exe
C:\Users\Admin\AppData\Local\Temp\DXE659.tmp\infinst.exe XAudio2_7_x64.inf
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3592

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s C:\Windows\system32\XAudio2_7.dll
3⤵
- Registers COM server for autorun
- Loads dropped DLL
PID:4260

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
"C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:856

C:\Program Files (x86)\Windows Live\Installer\wlstartup.exe
"C:\Program Files (x86)\Windows Live\Installer\wlstartup.exe" -QueueRequests -firstrun -context:messenger -hs:o5gtlzvcqz
3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1560

C:\Program Files (x86)\Windows Live\Installer\wlarp.exe
"C:\Program Files (x86)\Windows Live\Installer\wlarp.exe" -muoptin
4⤵
- Executes dropped EXE
PID:2204

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3
1⤵
PID:3376

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Sets file execution options in registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C85F5755FC5EEEC3FE32C4C960623274
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4824

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 93A847727D26DC5E425DC8E50E3A297C
2⤵
- Loads dropped DLL
PID:3552

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A4FA3273F88D948BB0E6503B1CDBD7AF E Global\MSI0000
2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4744

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /Create /tn "Microsoft\Windows Live\SOXE\Extractor Definitions Update Task" /xml "C:\ProgramData\Microsoft\Windows Live\SOXE\updaterTask.xml" /F
3⤵
- Creates scheduled task(s)
PID:4288

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriter.exe" /queue:3 /AppBase:"C:\Program Files (x86)\Windows Live\Writer\\"
3⤵
PID:4808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
3⤵
PID:4104

C:\Windows\Installer\MSI6F21.tmp
"C:\Windows\Installer\MSI6F21.tmp" -i
2⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\0ur6k8e7\Mail.cab
Filesize
13.4MB

MD5
f92a584528763aac5555455bdd183ef1

SHA1
5f602ed60dbd23b11312466ee0db5facfe4b688e

SHA256
24bdab9814e586970687bb26434d401963bd683f57cf99a542be11b1c8a429dd

SHA512
72d23e402a43a1c13a7f2572366c7ad089fa4a08c05ae4d8533537f0cc847dd06d5879e86d7f2777f92d12b1c0998d2b695edfa922f35d9321f11c258ecfa2e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\0ur6k8e7\q5kcitfw.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\0ur6k8e7\xnb5jkfy.tmp
Filesize
5.0MB

MD5
82561b917b3952246227d3706dec0ba8

SHA1
e7c91e2b33e49ae6b6cf1293f3a0c8c64a90b5d2

SHA256
93db78ad4bd2ab93a5162c47d8d4a45ddcdeb760b7c1cafd98bbd866c1ca0f77

SHA512
f3d56590b2831e5aefec8a5b933080fe3507d3e2a44cdc0971cc8aee0d1822583f57ece824c8fc5dca0064b583ef411ac5a8b702459bf94420cab521927f0c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\2xznll6v\0jr25z2t.tmp
Filesize
617KB

MD5
6971afaa9cc2552c74fdb965c2fb76d0

SHA1
2a384297c92a41f12d467642adc72b9b585374e5

SHA256
0dd513040077b5c7e1a869f1e1e1f709cc669d21105650e6515ceab34627d468

SHA512
af3a47a32f0c5f01623c1d280159995ae6102f986ff4c7b475b7235cddbf32296e726f2be4203de293095fdd18a5065c9d6855f1e4d072142ac793152f318055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\2xznll6v\crt110.cab
Filesize
612KB

MD5
d119aaf4bf4085612e9af0518bef08e2

SHA1
06a029c35d3161aeaeb7189f3cb27fa855c6fbf6

SHA256
d7161a6d9176ed76ecb13b0931bdef32cb3239e9559c875ebd9cd485a2e31d39

SHA512
015b19f5894c09df2a553f56ae3151a2ea0671020379dd818d1a7c1b9fe69772d67daed4e6c6afef5faf1aa9994a061345f816ad191ca0e20988c67b9c02ef58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\2xznll6v\hcu8u26f.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\581esvnt\Contacts.cab
Filesize
4.0MB

MD5
5f26b195ce2d0e31cee1efc7005eec86

SHA1
d7b8aa59ee38748d843033c066c6b61da57ccf64

SHA256
35debf728fc1abcbc96048e4d386b81c12bbe7ad1558e4ccee0002edd6b7da09

SHA512
55b037584949ba68993646c3fc49938890cc08c4a98766ee3d9e53d651db3dd2cb5a6399709690dc042ae1c9236aa26113ea416c333eb50b1218cb194615ef38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\581esvnt\qsww60kk.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\581esvnt\ve4gdnoq.tmp
Filesize
994KB

MD5
34983f6eb1552b4805a6766c9461cef3

SHA1
7f52a185a5c10c1291be7907731d1e990f8a4a90

SHA256
c4d4ce3d9a3a8c881281858045075997747a4ce8ea953a1f5f301e60a09093b1

SHA512
9f8e41f3b79cbf9b56b737abb779a6c4ab95aec07e9961240fb08efd1ed78fa677be9a9e841bc2bdd185631ecb986ad8820fb6ff098fe7866f7ce74f3d5ef6a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\6ua6tkxx\4yh9kn9k.tmp
Filesize
460KB

MD5
4ed866061580d42f96f09c16987462c7

SHA1
ee69d20909acec25024fdb8680a9dda03ad51d2c

SHA256
225a26cf9670ab0344b052474fe5ff576c808b53eed275d66efc51d16a149804

SHA512
4f9c871a138729e8af4970f7259ee44375de6a949452d0a768938d263b095fd76ebcb4354ce437d96c6c84d0562ff08cb2dd4fa5ace3fa497fb039113dd76e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\6ua6tkxx\8wssakso.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\6ua6tkxx\crt90.cab
Filesize
4.5MB

MD5
575a2172466e1a8b0f17bb3d64f0fc94

SHA1
86778234f14757b95f475dd6cb7fec32ff179cd8

SHA256
a2ae8965a8502654e7e8458c301dc0225d893a55d3c71b1cbbf6e9c0f3204a8a

SHA512
a79a9e7e2f101487d80de9ab6e4990502fffc932abd41549894bda32ac5707574e9b5ffe9f40f9f075915bb6a4c7d2215c28d461c1cdf45246f202c1121b6cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\am52ynei\Writer.cab
Filesize
8.1MB

MD5
c5330f75a5d459d0dd3726aa6be3fc3c

SHA1
11418bb5fae4742affe7a49e5f89620ea24b0095

SHA256
0a470872cc8095a4034b69badd4886bd0f71b3d62677b1e77c76f1f6b832d00f

SHA512
cb36639517a800abf1da4a4cb19b8fc9afb8ca4eee4e25492e8a822889f2b15c2efda2cd022fe0086922ac8a267d4af972d149bf85a74e02251ee894aec8a569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\am52ynei\iqlrtlgp.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\am52ynei\vwo9x0h1.tmp
Filesize
2.6MB

MD5
946d0ef0c10be09faf6b75036fbc3b6e

SHA1
90ecda1b321e1aba7b87063085020e02b2e0adc4

SHA256
e9eb222f5845ed9dafaa71be18625671a3f6b152779a56aea1b243863b0e6296

SHA512
081330f8a7e0a35aeec4c6f006720c147ca1c2e6eebfe112cff68d0a5d8950e8bb59cdc4adc6da5e4dac9ea7af0abefa14ced2c7a5a0a5bea41bc8893ea4baa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\bhd8odwp\1qim7x4o.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\bhd8odwp\1qim7x4o.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\bhd8odwp\D3DX9.cab
Filesize
3.4MB

MD5
692b02ad89ed82727a47247556320ea8

SHA1
cfb54a9792ca16d8fb8c35513015abd5ae996ea0

SHA256
ada3f11e2be0f1e9faf4634de6cf5f95eebb65d24ec6b9220b479b70fe584be2

SHA512
1a9165fe1001671ab3d3f8bc9eb7532b95848c7b0582e3aad8bad53ed90dbbca0a6df1fa154afac9f4d18184a51422ca72131e92cb977ec3e25d2d860814229a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\bhd8odwp\cy2jiye7.tmp
Filesize
3.4MB

MD5
a6bcdb8f4c2995fdd878db23f9d800f1

SHA1
3d58e01f26811095e7ab09ef7ca117ffbb831276

SHA256
ef36704ed00de8491b983b191968fbb8a06d17af675de19dcf0506edee8f26be

SHA512
5f6fcf82275b567b56b59f1e9485102a6c7fa94b63d3b1f72501f498d82802b5d9d1f8650cd82e489d0616573a58ce808e1c9021ac01b2e9b8f9ec5d3e567812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\ebs6orty\7zd37mcb.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\ebs6orty\Watson-x64.cab
Filesize
1.8MB

MD5
abc26cf06709db3146c92e0c8377a8b1

SHA1
2125a3554005ece8524b919815fdd9cc1037a66b

SHA256
cebe84014bfea44543c3c956d665b2d3d30c0308b80ca90a831b9c7d846356cf

SHA512
48906552f9a7b90ac76a242601739e3533859117125b912f02c40a38a756a9099bcc291cdbe98e1a9bc832bd734dbad610d9994223624127c8a28cfe0829c9d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\ebs6orty\dqf5g89t.tmp
Filesize
1.8MB

MD5
a6b1bf5479520ded28fa779a66c14dad

SHA1
1e14710a9e9c58ce227b9d4b2c960997a5577815

SHA256
b0cd17b8c87e89a17743c8f1c75e401984b4ba2a8127f38aaef62c83cfdd4df3

SHA512
28063d56c23123c38d0bbbf8a9ba5b5dd2630c379ad8592973bf84139a91b392a8b32f8a9ec4fa82adc6426192c85b9c15860b87880a4bcb459cb3cdcb063758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\exptl2k6\D3DX11_43.cab
Filesize
2.9MB

MD5
169d9f118ff7ddc6fd8388e673c0b72d

SHA1
23c5bcfdc3e8ea04951805bcf8736f4dfd9b11ae

SHA256
82670e1c9092db7e00b9c91cf73c7b12251e4714ec66926f3bf616b2ce8df98c

SHA512
31b02fb847c0c9ac1fd01ff8e802f61d83a9e3197813f181395c7fe53d2e7096be6617ca169af1c827be97fc44c080f2b23d4a4f78e026a6d785ec4552af2ef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\exptl2k6\hdfmmkw5.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\exptl2k6\tdc3incq.tmp
Filesize
2.9MB

MD5
46869c11974313746173fa325517d5d5

SHA1
ee07cc2700fd628cd55a9083b440efd394803172

SHA256
967c62f26e6556453e5a38ec192f02fd25bbb983fdd2c9ccab012528b9001dd7

SHA512
f273ac7affd55675711335e3d948d94aeb86ef8a06db0b972017f2d08ee6d3efe9ffa5ae0c10d4c3acd32a13895a4b4753a457c11f2a0ac59c1bd49eab528b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\f0nhpudl\99m94jor.tmp
Filesize
8.4MB

MD5
6df970283c8a63f0c3c96bcd8a2e16cc

SHA1
397ac5cf014b1e2cd0bc1194b7d43fac6792ba25

SHA256
a10016d35de6b62964bc9ddb0bb535afbf7797954a3e9e7c8ffc483ff1ea9feb

SHA512
ca6c19c06ac2c9efa8da9fa30e0d4b1f60ad7ad15e8136f3a76cb21e316e9a105d178aa203b70fcba281bb694e36d1eda2362038102851bfdf9eed584e35cd8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\f0nhpudl\Messenger.cab
Filesize
21.6MB

MD5
2c1afe7ccebb3383cda41220cb5fcb44

SHA1
8dc889d3b9cbb1f2273be5a49ee9ed83b8aa8f25

SHA256
105a9210eab1d20046b25c49cf8f57672968a565c055820f8b02a07b9787e5ae

SHA512
b8fe418e7f4465102b9f50be6b8e1dbff8f2605ec51dd29f89a9aea019fa47e0b5ea1142fc1737e6e64dc224745d2dc5b522331dc4acffba7d78f15818ca6807

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\f0nhpudl\zb6qyfl2.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\gi6u5qbq\2vjnsfyz.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\gi6u5qbq\UXPlatform.cab
Filesize
9.0MB

MD5
c012292727bb374cfa9dd557ee29d2b4

SHA1
123197276bae304ba78ee833dc6f9d9e59a0b0b8

SHA256
6e2eb5f8da9c05983c68c9e9df6d3a449bdd940526795564f34381d254e30766

SHA512
38e34b21c60c3f5055e2e844266dc1a52085e3036f11fcd589972dc75ac68cefe777a6a2947de3a9a002271b7ad3e7bae5f3d49e133a34f4af615c32ce488a51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\gi6u5qbq\rjl24sm0.tmp
Filesize
3.1MB

MD5
1d71f23b16a5fa228583e8d43861b114

SHA1
947a1bbd7478f586bc59c42962dd3a0ecffc5d1d

SHA256
fc75b41a31b7d2d91ccf1b49c801ec6233af8f83bb98b10247a65041d5b58f2d

SHA512
a2ee87cd8da55f4ce7f81cbe7a15f08054478ed8222e71019fc7069e6cf8acd6f63b341557c3439b833d4fe69ed84688beea08fabfeba04fd7603fdac9f7a591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\kyd97vja\SpamFilterData.cab
Filesize
3.5MB

MD5
80be60323e164f434442a367f4a8d963

SHA1
cdb5ac81eff9a1cb3ab38c6f7894b08552d824f8

SHA256
5098194ee02d102d35af5329e11fb4be450dfb957e575ce3de5649e6fbcaad99

SHA512
383db2da04b5738b0cf80b87c4e449ce20dbda4bd566bf9cb68178fcbec5903499383ecae99b01165d048b1516d24556a0c474934ba9da2e004345ace0c39ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\kyd97vja\m3y7qr3i.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\kyd97vja\pykis5pc.tmp
Filesize
3.1MB

MD5
58597683b7f1a2e899639f3938ae4b23

SHA1
e20fdc898917b93f43b89fb73f35e426bc59b424

SHA256
671d55ed8726d53b9773f1efd2d89ac7f0bbd084dd80dbfac1bc3aa12625c3a7

SHA512
2303c6c6ff96d8b261f1b02455614333efa182e0ebea979bff93af241432ff83a5d6fced1608cacdca427e144a4f8547b5d22a507e6a034c3b00d94e4c5df10a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lerubtnv\4p4605tp.tmp
Filesize
23KB

MD5
7b68481c3758c89baf84408ca6a516a9

SHA1
50bfcb68317aa5c41bf163b1e1d6b9a3e1b50d45

SHA256
7a6ad74823dacf11e46e4b9d720bb610ddf0b0653963d616671e926748133e0e

SHA512
ad4b42ec85c977f31ee552bb51287e46333ce163e2652f3d640d87431e059cd8e5426241e34c37ac3d23806ecac05b042311db5ebb1b0553016c4353b7baca1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lerubtnv\soxe.definitions.cab
Filesize
175KB

MD5
3bd00551de772995f7671a6ba45d65ab

SHA1
8249b2c28c73cd3a0bae4067e5cbd8c0e65d6923

SHA256
23c26ddeb0a3576c50d7ebae995a807163c63fdd5e8319aa071d13fa9a0a6496

SHA512
4e40ad0e7a414911b578ec515666475f9ab981723760fb6aa0b697e417a004cbae725f1ab295ac3026d22323dddab9db7f298d2cfebba854a1f2bf5ff5a6b6eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lerubtnv\y0warmcy.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lkryf9aw\3nom5dmo.tmp
Filesize
646KB

MD5
3ffdc68017839bba5212426593646e16

SHA1
d159eab8ad10eb07cf15f55c52220748fe1d30ed

SHA256
cc40009fe1e528af8bb5f24687324999d36e948d69197b88761b0e93d704eb0b

SHA512
7cebe2dfe1384bee8dbbe0afef02b11b0c70fb612eed85ce3d53228a629338b250922fb93f503195734106fc83aa7a35961c1caf0a12d41e92e068c79afa10b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lkryf9aw\crt110_amd64.cab
Filesize
645KB

MD5
52eeeca22f1c4f393702ab75ca4a0c7f

SHA1
188c56555be4bfddabc1bdfbee827e47ec6b64b9

SHA256
bc1671181fb9179dbf6e326b23030e0ffc19c9a2b084c7c28ad80152b40569a3

SHA512
cd6feb5535807253b64923029d6d4ea4c2a7464eee1ec2ce07af5c224ee3a714f537ba7327f105b223fddec08b1297b0a61150537222b19b061ed06fa2abb624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\lkryf9aw\qnvzc2ak.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\naggfi3y\0ntx5wrk.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\naggfi3y\WLMimeFilter-amd64.cab
Filesize
111KB

MD5
884151b8b5afc0d83906dc8ee1a6f7e9

SHA1
841185a41287ccba75e47d894da3e74b9be22283

SHA256
31ff81d5c58140dfdc900c33fbd23bf9546b67b4e45b436da357a7f19ffef607

SHA512
0995cd15a11ffaf6841b93cda3ef1f07930a7d6519a338d9b0267a948c5232fbcbf9e4c33bf0638e8b0397f427ce5a1e01182e2eac1a8bc85335d2725aaccc59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\naggfi3y\yf6yt24r.tmp
Filesize
35KB

MD5
f273437319eacfe6980b8b509f5da862

SHA1
05f81d8954108e07a4d78d4ffd6b2d3367f0c4ee

SHA256
f01b626d3931848e8ac2c7d646523e6609a71d91da4c7fa6c2f5248984e529e6

SHA512
6fbcf76d6f76c47b39287fc379672fe2545ffdbcd30e1e092a5d65abb52bb018a9da19c1211763926b3c8025c12e2dd231b12cf76775d667ff7283f5ea623839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\pu33509z\1n47mmma.tmp
Filesize
660KB

MD5
ee3ac9d9b218516b43d3a2b8f2a24508

SHA1
8f0e3f8edc39a816f2c8edd171a7738c45bfb6bb

SHA256
98f6006ffb554539cf1cf6be46795e7e6b9b1592ae42a97f780a467badb07ada

SHA512
0048ffd26aad92b1545414c99c5825315f8538a34d46017629be49e9ebe817cb5a5bfa3aa699afe4316f886bb2791d84609cc7e10b589a2e2584be51788e28c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\pu33509z\4hf0naqm.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\pu33509z\PIMT.cab
Filesize
2.3MB

MD5
801f96ac4b7e12b9691c12e94c7abe2d

SHA1
05b2618a84a080d3e41725bdc6f73632cfbb4a8f

SHA256
a030b62c1da3ba7d8821e60fb4427c9041fbc077867b59a528371b5e5cdc419a

SHA512
a75d0e8074f55bd1cacc3f6b7938fd111d5328963dfb6573f0b2f1e8ab9738887b2f55e657893d37319feb922e4bd998e20a91a516d7783f472bc8fff5aef95d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\uohmidja\d3dx10-x86.cab
Filesize
2.2MB

MD5
e2c883cf5af7ffd177c2e885e7b9211a

SHA1
1133cc73222ee105989ef10ac06a421f62b77ab0

SHA256
100f6fdade69a4efa4e315154046b13e5dd6af2d091a573f27dd922f242c07dd

SHA512
bc9e8304cfb131ac300485d9b2a221da434733b23a9b7235b044ce22fdaf0c0ba22ed74caedfbdfb1a044345bbb04d954e2d6cb3b74591c4c5df324ea99c679a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\uohmidja\hv9h1klo.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\uohmidja\t0h5pbsh.tmp
Filesize
750KB

MD5
5a9d80b5422ab12c962cb2e62e865485

SHA1
9a0e76535e25e71bb9225509a32ab95df5c0703d

SHA256
e05f4900a6c6765a339a12fbe2d4a163413c09432d9845934ad9e0ffc032790c

SHA512
ddd059f2435e113c3bcb3cceb2224dee2b566ec6a1283a18f50861ef9499df73cdc6fb7ec88a11285b0a431bbf98ba678b8f0c17868214a34629c5b9066d082a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\vsoerak2\0h21xh6y.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\vsoerak2\D3DX10_42.cab
Filesize
802KB

MD5
0a1d01413e017982e2d9d819e94b6a11

SHA1
9fa93226a928772754a0e30e8872d961a013a7d9

SHA256
b77ba929b68ba8fdd40209ddf39ad6443b0513b7be639c87f69d8afba90173c7

SHA512
881b22755fb56f38cef0d668ef23df14e3ee0e85218cfd485add3d102da25eec5aa00931dea3ff6934077e03d8eb4f93e688518a37ecc7b308c23d443e47253f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\vsoerak2\mn7tquu7.tmp
Filesize
799KB

MD5
0edc6461b2b7af6dcec4a152c6d12797

SHA1
0c0f0df6223a061e7661d772761020ac2e2e06a2

SHA256
5a754fc90bfa2f60b3a0fbf45e9ff7658f77daa08debb2bdb6ca6c26304bd627

SHA512
54a540e6e410fc7740317e494f60c8b12b2b824fe5ede4d5339e79c0cde4ff8db09f1c9c4350cf175cd6898a77e74e8efe5973dc526e3d990380940c01e0a99f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\w3efq6fe\PhotoCommon.cab
Filesize
5.2MB

MD5
b37655c4d63f411a6b23eaf89bf981cd

SHA1
09cb0a0f7bec9b62db44d24a1aa11b4fdd40c7c7

SHA256
108c6d632199dfb6146d86c35b7aaa29443ba869d46dd99605ca9a455f0c7217

SHA512
2169c6e9a7482643003a41fdc3dd27d67bafac415cf393c4b75e53766ad68e13616b790a7e1d7933499c1b86410e5f8ef5e1413fd93ae0ab0462b5ae526770aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\w3efq6fe\cekooi7z.tmp
Filesize
1.5MB

MD5
482282c1d8b97485791896ff1d5de587

SHA1
187adb3cceaeb7c566af159e1fb832d555e9b50a

SHA256
b9e4292c40d759cf1fd235463429912fd70a9e5f0d4bd8fb8ac9f0a6cbb8dd9e

SHA512
e05e1982b8aa9259127e8966dfd5e085b435b114253133fb417fd50985c13ec9a0f0bd58dd52a82ce695a11e697f7f21e96bf40a00cf6888b16e8689139d325c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\w3efq6fe\o3ahiya6.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xe7h3bjm\9mhg3y49.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xe7h3bjm\knc0d756.tmp
Filesize
148KB

MD5
6fee869fb755bace369d1ab411e7b378

SHA1
c7f5a525cab44441e30de2fcd2b17d60c099d40f

SHA256
ea894ba961f35cbd34f63a5569a8fc9642bf82ed5d6cf2df2618d84e7328feff

SHA512
c6175007077dab80a11e2bf4606735fc382d602f60c2ab26e90e221ae1aaeca9e782c8698e589e0e4299b43e02b1c68b59297737ce820f870742dbf141560107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xe7h3bjm\soxe.core.cab
Filesize
484KB

MD5
22ca63e33ab582842692359e8178ef1f

SHA1
da6d9d58e849cafed8a58a331ef1ffd17ee085a4

SHA256
48f7e9437dc980c37c284e3157f5651663725cbae5e4341f70e6672972cb87fe

SHA512
caebfa50b3c1f8b64bcd08b08d6f3b41ed6e4683767b5764ae2b636bcd67bbe845aa38747c0bd6bc9f552d24dc89a00e43cdc2668d1645ea7b4540768be702a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xg5e9yyj\WLXSuite.cab
Filesize
8.1MB

MD5
dd4976b6bbde52aceed41ea0e619c7cd

SHA1
eb0d5db7445bfcd5254c0b1e95cd60aa0f16105e

SHA256
2e14e58be3fa84b292bd49be75a053340c878956c5f7eb76bf1d68464e0b9648

SHA512
a7502c2e40a99aa508731c0cfb0fe6317c64381816ad6fc0a3524f7540559d762261e0a957235bbf128ab75adabcd8dbbc425e71d577376e859712084593af2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xg5e9yyj\qpru1mdw.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\xg5e9yyj\zj4axyhh.tmp
Filesize
2.7MB

MD5
6b0e1c4a026558ebd9b7adf2478256b4

SHA1
09d4806b572891dec18f8ea36fc783ae3fa2f333

SHA256
f4d56250a6ad6ebe6d16444e7bb65daf8cadc94e12be7d7f4a156acbb52f1059

SHA512
a8e8f71b202a4ae1bdecdd7ac1b96e791d6663aa731def39bb561c89d350a1029c41a7aaee133bb8c8d68502a45ca4fef16d2192df6592db711011a9523150e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\z116nu89\1669b4cm.exe
Filesize
64KB

MD5
b3695953f17eb4ef1c67422007304546

SHA1
a4915419b346f11d304f337f4e9bb627be5171ea

SHA256
650b8d8737e5565709c740508b41b187720eaa32edd12f8b66bacc27f2270953

SHA512
73b5aab985ca473b88d2efb3386a0c22eec12c035bf6f89e23905d58e6e5cd83d71ecf2909e06d661011da4987badc1b5a071613980260c5bc75a9e48ee93db2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\z116nu89\crt90_amd64.cab
Filesize
3.6MB

MD5
6ad524024eda69be12344c4b7e578ae2

SHA1
71418699513caba5354e329ea5d804752e4603fa

SHA256
1271fca2ae74c41ed1a17aa87749bdd95586266e05825c14794586b9e6293b2d

SHA512
e4db5666130714dc566a8ca0478d39be85e666b058fa8fc0c25f2b5526f9b5576a574eb560b5e46d330fd2fe48b8542fc2f9497df641a44767a1a6085e595580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Windows Live\Setup\tmp\z116nu89\ivpgdbah.tmp
Filesize
470KB

MD5
687db3c1547f83f3f65ce6aa8d230293

SHA1
8243cc311faf8b477e0a0e1b61fa7d12a178e5b0

SHA256
34efdd985fd8525343f80b15305f59149f2ff764a655bf045c42f597a7d98fb0

SHA512
872b18717b20b6449c05dc3364a5862a39dae81ec76cc590a3ab842e3a3affdae614daa8935ef43a0e3dd7ef4d649d6fcc44eff5d0338d0ec4e08e1c52feb5a8

Download Submit
memory/520-187-0x0000000000000000-mapping.dmp

Download
memory/760-225-0x0000000000000000-mapping.dmp

Download
memory/856-246-0x0000000000000000-mapping.dmp

Download
memory/856-247-0x00000000000F1000-0x00000000000F3000-memory.dmp

Filesize
8KB

Download
memory/944-159-0x0000000000000000-mapping.dmp

Download
memory/1092-147-0x0000000000000000-mapping.dmp

Download
memory/1200-203-0x0000000000000000-mapping.dmp

Download
memory/1544-175-0x0000000000000000-mapping.dmp

Download
memory/1560-248-0x0000000000000000-mapping.dmp

Download
memory/1716-171-0x0000000000000000-mapping.dmp

Download
memory/1884-230-0x0000000000000000-mapping.dmp

Download
memory/2088-195-0x0000000000000000-mapping.dmp

Download
memory/2204-249-0x0000000000000000-mapping.dmp

Download
memory/2544-233-0x0000000000000000-mapping.dmp

Download
memory/2580-179-0x0000000000000000-mapping.dmp

Download
memory/2732-217-0x0000000000000000-mapping.dmp

Download
memory/2812-226-0x0000000000000000-mapping.dmp

Download
memory/2812-167-0x0000000000000000-mapping.dmp

Download
memory/2948-216-0x0000000000000000-mapping.dmp

Download
memory/3148-135-0x0000000000000000-mapping.dmp

Download
memory/3152-211-0x0000000000000000-mapping.dmp

Download
memory/3188-220-0x0000000000000000-mapping.dmp

Download
memory/3256-224-0x0000000000000000-mapping.dmp

Download
memory/3412-231-0x0000000000000000-mapping.dmp

Download
memory/3516-219-0x0000000000000000-mapping.dmp

Download
memory/3540-151-0x0000000000000000-mapping.dmp

Download
memory/3552-218-0x0000000000000000-mapping.dmp

Download
memory/3552-238-0x0000000000000000-mapping.dmp

Download
memory/3592-235-0x0000000000000000-mapping.dmp

Download
memory/3712-130-0x0000000000000000-mapping.dmp

Download
memory/3856-227-0x0000000000000000-mapping.dmp

Download
memory/4036-228-0x0000000000000000-mapping.dmp

Download
memory/4104-245-0x0000000000000000-mapping.dmp

Download
memory/4112-143-0x0000000000000000-mapping.dmp

Download
memory/4228-183-0x0000000000000000-mapping.dmp

Download
memory/4260-191-0x0000000000000000-mapping.dmp

Download
memory/4260-236-0x0000000000000000-mapping.dmp

Download
memory/4280-232-0x0000000000000000-mapping.dmp

Download
memory/4288-240-0x0000000000000000-mapping.dmp

Download
memory/4328-155-0x0000000000000000-mapping.dmp

Download
memory/4344-207-0x0000000000000000-mapping.dmp

Download
memory/4360-229-0x0000000000000000-mapping.dmp

Download
memory/4476-163-0x0000000000000000-mapping.dmp

Download
memory/4488-242-0x0000000000000000-mapping.dmp

Download
memory/4488-243-0x00007FFBA7FC0000-0x00007FFBA89F6000-memory.dmp

Filesize
10.2MB

Download
memory/4508-139-0x0000000000000000-mapping.dmp

Download
memory/4536-241-0x000002BCA5750000-0x000002BCA578C000-memory.dmp

Filesize
240KB

Download
memory/4564-223-0x0000000000000000-mapping.dmp

Download
memory/4744-239-0x0000000000000000-mapping.dmp

Download
memory/4808-244-0x0000000000000000-mapping.dmp

Download
memory/4824-237-0x0000000000000000-mapping.dmp

Download
memory/4824-234-0x0000000000000000-mapping.dmp

Download
memory/4932-199-0x0000000000000000-mapping.dmp

Download
memory/4980-221-0x0000000000000000-mapping.dmp

Download
memory/5060-215-0x0000000000000000-mapping.dmp

Download
memory/5080-222-0x0000000000000000-mapping.dmp

Download