deec97bb19aac63240ec1519358acd150eb22ad4c728d5566fb2255f8696019e

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2023, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

harmless_Windows_Update.msi
Size

7.5MB
MD5

99a83e21b443353cb7e7af34fe9b2aca
SHA1

2ff2d7099606a4fbeec1adb9d80e7f4d46a74534
SHA256

deec97bb19aac63240ec1519358acd150eb22ad4c728d5566fb2255f8696019e
SHA512

0218afbd509f45d484edd5397bdee8a0e299b53298d40867fa284ae973d4b484082c7127cf1b0ebc65c815cb111df927ccb0055f5374056f6263e30683d9d975
SSDEEP

196608:X0Bow2dd8WhtXXtQrHjzbalgfrzABA0DM2IsukuARWY8q:XQ6ddLxQHfgfA0DM2IGRWY8q

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1752	msiexec.exe

Loads dropped DLL 8 IoCs

pid	Process
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe

Registers COM server for autorun 1 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\LWAPlugin.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\LWAVersionPlugin.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\LWAPlugin.exe"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\LWAPluginInProc.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\LWAVersionPlugin.exe"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\LocalServer32	msiexec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5685af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B30.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BDF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5685af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI894A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9798.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BEC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E5F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BE6D5464-0B1F-46CC-8973-F9651FE6A45A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D26.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI96FB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5685b2.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8707.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2E01B46-D49E-4C8F-9FF8-4B3E6FC770C4}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C6CF2189-9728-4F8B-91BC-012D6107D209}\AppName = "LWAVersionPlugin.exe"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2E01B46-D49E-4C8F-9FF8-4B3E6FC770C4}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2E01B46-D49E-4C8F-9FF8-4B3E6FC770C4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\LWAShell.exe = "10"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2E01B46-D49E-4C8F-9FF8-4B3E6FC770C4}\AppName = "LWAPlugin.exe"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C6CF2189-9728-4F8B-91BC-012D6107D209}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C6CF2189-9728-4F8B-91BC-012D6107D209}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\LWAShell.exe = "10"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\LWAShell.exe = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2E01B46-D49E-4C8F-9FF8-4B3E6FC770C4}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C6CF2189-9728-4F8B-91BC-012D6107D209}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.ComponentFx.1\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{5816ABC4-992D-4B04-B2A6-1841DD0A8421}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{4296FD4F-4C63-4A1B-B8F4-678B77F2C415}\ = "IInProcComponentFx"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\AppID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\LWAVersionPlugin.exe	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.VersionQuery.1\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\ProgID\ = "Microsoft.LWAPlugin15.8.VersionQuery.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.ComponentFx\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\ = "Microsoft Lync Web App Version Plug-in"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{C6845707-587B-4DDE-9722-959E3221E295}\1.0\ = "VersionCheckerLib"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{5816ABC4-992D-4B04-B2A6-1841DD0A8421}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\Control\	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{B891D2F6-325B-4901-8F98-DF238F224BC9}\TypeLib\ = "{A70AE74C-428F-4291-ACA5-AE3DC7C9801D}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{4296FD4F-4C63-4A1B-B8F4-678B77F2C415}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{4296FD4F-4C63-4A1B-B8F4-678B77F2C415}\TypeLib\Version = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{A70AE74C-428F-4291-ACA5-AE3DC7C9801D}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\TypeLib\ = "{C6845707-587B-4DDE-9722-959E3221E295}"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\AppID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\LaunchPermission = 01000480740000008400000000000000140000000200600004000000000014001f000000010100000000000512000000000018001f00000001020000000000052000000020020000000018000b000000010200000000000f0200000001000000000014001f0000000101000000000005040000000102000000000005200000002002000001020000000000052000000020020000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.ComponentFx.1	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{5816ABC4-992D-4B04-B2A6-1841DD0A8421}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\VersionIndependentProgID\ = "Microsoft.LWAPlugin15.8.VersionQuery"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.VersionQuery.1\CLSID\ = "{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{C6845707-587B-4DDE-9722-959E3221E295}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{B45F47AF-4758-48C2-89A6-AEDF6DF86BC3}\TypeLib\ = "{5816ABC4-992D-4B04-B2A6-1841DD0A8421}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{A70AE74C-428F-4291-ACA5-AE3DC7C9801D}\1.0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{F1349202-D9D4-4019-A1F5-DBA0659D7419}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\Programmable\	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{B45F47AF-4758-48C2-89A6-AEDF6DF86BC3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{3F246E2C-187A-4A38-9F3C-E8E0E90F0620}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.InProcComponentFx\CurVer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{A70AE74C-428F-4291-ACA5-AE3DC7C9801D}\1.0\0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.InProcComponentFx.1	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.InProcComponentFx.1\ = "Microsoft Lync Web App Plug-in"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{A70AE74C-428F-4291-ACA5-AE3DC7C9801D}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{A70AE74C-428F-4291-ACA5-AE3DC7C9801D}\1.0\ = "InProcFrameworkLib"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{C6845707-587B-4DDE-9722-959E3221E295}\1.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Microsoft.LWAPlugin15.8.ComponentFx.1\CLSID\ = "{1CC6F158-C938-424B-A757-8DC337545084}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{B45F47AF-4758-48C2-89A6-AEDF6DF86BC3}\ = "IComponentFx"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\AppID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\TypeLib\{5816ABC4-992D-4B04-B2A6-1841DD0A8421}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\Control	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\LWAPlugin\\x86\\15.8\\LWAVersionPlugin.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\Programmable\	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\AppID\{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}\LWAVersionPlugin.exe\AppId = "{53C06A7B-FC1E-40E6-9668-31CD219BAEA7}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\lwa-cu5-hf	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\MiscStatus\1	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{40C37B6C-D273-41E2-8122-A338BBDB2528}\Programmable\	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\Interface\{F1349202-D9D4-4019-A1F5-DBA0659D7419}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\lwa-cu5-hf\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\WOW6432Node\CLSID\{1CC6F158-C938-424B-A757-8DC337545084}\MiscStatus\1	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe
3408	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1752	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1752	msiexec.exe
Token: SeSecurityPrivilege	2404	msiexec.exe
Token: SeCreateTokenPrivilege	1752	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1752	msiexec.exe
Token: SeLockMemoryPrivilege	1752	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1752	msiexec.exe
Token: SeMachineAccountPrivilege	1752	msiexec.exe
Token: SeTcbPrivilege	1752	msiexec.exe
Token: SeSecurityPrivilege	1752	msiexec.exe
Token: SeTakeOwnershipPrivilege	1752	msiexec.exe
Token: SeLoadDriverPrivilege	1752	msiexec.exe
Token: SeSystemProfilePrivilege	1752	msiexec.exe
Token: SeSystemtimePrivilege	1752	msiexec.exe
Token: SeProfSingleProcessPrivilege	1752	msiexec.exe
Token: SeIncBasePriorityPrivilege	1752	msiexec.exe
Token: SeCreatePagefilePrivilege	1752	msiexec.exe
Token: SeCreatePermanentPrivilege	1752	msiexec.exe
Token: SeBackupPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	1752	msiexec.exe
Token: SeShutdownPrivilege	1752	msiexec.exe
Token: SeDebugPrivilege	1752	msiexec.exe
Token: SeAuditPrivilege	1752	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1752	msiexec.exe
Token: SeChangeNotifyPrivilege	1752	msiexec.exe
Token: SeRemoteShutdownPrivilege	1752	msiexec.exe
Token: SeUndockPrivilege	1752	msiexec.exe
Token: SeSyncAgentPrivilege	1752	msiexec.exe
Token: SeEnableDelegationPrivilege	1752	msiexec.exe
Token: SeManageVolumePrivilege	1752	msiexec.exe
Token: SeImpersonatePrivilege	1752	msiexec.exe
Token: SeCreateGlobalPrivilege	1752	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1752	msiexec.exe
1752	msiexec.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3408	2404	msiexec.exe	86
PID 2404 wrote to memory of 3408	2404	msiexec.exe	86
PID 2404 wrote to memory of 3408	2404	msiexec.exe	86
PID 2404 wrote to memory of 4952	2404	msiexec.exe	87
PID 2404 wrote to memory of 4952	2404	msiexec.exe	87
PID 2404 wrote to memory of 4952	2404	msiexec.exe	87
PID 2404 wrote to memory of 4176	2404	msiexec.exe	88
PID 2404 wrote to memory of 4176	2404	msiexec.exe	88
PID 2404 wrote to memory of 4176	2404	msiexec.exe	88
PID 2404 wrote to memory of 1520	2404	msiexec.exe	97
PID 2404 wrote to memory of 1520	2404	msiexec.exe	97
PID 2404 wrote to memory of 1520	2404	msiexec.exe	97
PID 2404 wrote to memory of 4892	2404	msiexec.exe	96
PID 2404 wrote to memory of 4892	2404	msiexec.exe	96
PID 2404 wrote to memory of 4892	2404	msiexec.exe	96
PID 2404 wrote to memory of 1488	2404	msiexec.exe	95
PID 2404 wrote to memory of 1488	2404	msiexec.exe	95
PID 2404 wrote to memory of 1488	2404	msiexec.exe	95
PID 2404 wrote to memory of 1768	2404	msiexec.exe	94
PID 2404 wrote to memory of 1768	2404	msiexec.exe	94
PID 2404 wrote to memory of 1768	2404	msiexec.exe	94
PID 2404 wrote to memory of 64	2404	msiexec.exe	93
PID 2404 wrote to memory of 64	2404	msiexec.exe	93
PID 2404 wrote to memory of 64	2404	msiexec.exe	93
PID 2404 wrote to memory of 2112	2404	msiexec.exe	90
PID 2404 wrote to memory of 2112	2404	msiexec.exe	90
PID 2404 wrote to memory of 2112	2404	msiexec.exe	90
PID 2404 wrote to memory of 4424	2404	msiexec.exe	89
PID 2404 wrote to memory of 4424	2404	msiexec.exe	89
PID 2404 wrote to memory of 4424	2404	msiexec.exe	89
PID 2404 wrote to memory of 940	2404	msiexec.exe	92
PID 2404 wrote to memory of 940	2404	msiexec.exe	92
PID 2404 wrote to memory of 940	2404	msiexec.exe	92
PID 2404 wrote to memory of 4160	2404	msiexec.exe	100
PID 2404 wrote to memory of 4160	2404	msiexec.exe	100
PID 2404 wrote to memory of 4160	2404	msiexec.exe	100
PID 2404 wrote to memory of 3084	2404	msiexec.exe	99
PID 2404 wrote to memory of 3084	2404	msiexec.exe	99
PID 2404 wrote to memory of 3084	2404	msiexec.exe	99
PID 2404 wrote to memory of 2928	2404	msiexec.exe	98
PID 2404 wrote to memory of 2928	2404	msiexec.exe	98
PID 2404 wrote to memory of 2928	2404	msiexec.exe	98
PID 2404 wrote to memory of 3332	2404	msiexec.exe	91
PID 2404 wrote to memory of 3332	2404	msiexec.exe	91
PID 2404 wrote to memory of 3332	2404	msiexec.exe	91

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\harmless_Windows_Update.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1752

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9C33D69EE53E02C10C4553066078285
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:4952
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:4176
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:4424
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:2112
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:3332
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:940
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:64
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:1768
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:1488
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:4892
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:1520
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:2928
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:3084
- C:\Windows\SysWOW64\MsiExec.exe
  C:\Windows\SysWOW64\MsiExec.exe /X /qn
  2⤵
  PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5685b1.rbs

Filesize
58KB

MD5
47667d6c8507a28d26674a3241e2000f

SHA1
9da60956415cdca852936d6d6fcff7db22022bfa

SHA256
9542aa96016f89802309b976e5c44f7cd9d43002ea66529051e06ae936fdc34c

SHA512
3e81c0500eb777e36033b6855cd8f3cebcd1106cd0ccc53ff8debfeff0e09cd07ee3335a6fd0072e27059f6c6221919fd74673e949b2fd27146ee7587892bf0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\AppSharingChromeHook.dll

Filesize
26KB

MD5
005f51f9362f639fedecfc4773a424a2

SHA1
99fe6364cf8156d0575fc3b3c519c26a95ae56a6

SHA256
68da1f97a2386fa2f0c52cbd17039144bb4ffb71d734b59a97495f35822ae4e3

SHA512
3a226039466dc0cac2a658d3416438577de2414e7aaccb195d606509b39bd22ea9be0fe67e20132d7c9c525c67b3ff410025233cab6f8e17ad2defe0c4069b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\AppSharingChromeHook64.dll

Filesize
44KB

MD5
51c01401cb022e2a9205a58f4da50d46

SHA1
2da5a515c06edc10e0a354d30d79461979dd5c16

SHA256
82666f7e55cc499ee12de451dabf2f9ea3684fae297f2bdb284a3e39b406999c

SHA512
73f5651d687cad36fbaf7b27172fc2f1f82e63af764cb0444a4bf82ee50d4c51521330c7de794faf0f1cde63a6891ffb9427041c79e9dbd82e4f88b4d71fe407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\AppSharingHookController.exe

Filesize
104KB

MD5
34d489c553f0eb7cf0ab4f9ec5eafa6e

SHA1
0cd4d93daa3ba4ea11b287154880ca4476a45f2e

SHA256
39138943a394cbf01d237a42325a3554a6a2891924eefd5dd4d6a7b8786f5cd5

SHA512
e8c146332ef5e1e46210692fb7e433ac2ae817af5ee3c928f508091620a0f82fd19916e65951a7a63c027c4db763b399f2ed3de38914ddd608ef06ff64838fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\AppSharingHookController64.exe

Filesize
154KB

MD5
8b227cafee6be3408421633b9b2755e8

SHA1
0ef26c9b30b69a7baf1b4b33f988c4cbeba5c6ac

SHA256
5ce76d6931a37786d3c97fea98238e52a441b3cd2edbaccacc37e85dbc046523

SHA512
f27c6d49753b43ec076aa42e9f7ca13ee37f22448c4bf79dd6505c8b29de6891249616564ddbbdd884c71f27a2ad96e5470656a8656cdaa7826af5f1ec9e009b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\AppSharingMediaProvider.dll

Filesize
90KB

MD5
eb94b3e3cbab301a4b4825a599ce32e3

SHA1
fa8c3c441dc6fbbf2d198d7c154b71f331d298cc

SHA256
a57ab76e38b2a9fc768a97e2d165a04dd5840c932282311072ea32bc806af08b

SHA512
a2022f451996cc1fb0851520b94b144e0360d66b35a5a4b201d81f865cea78bf86af705ea62d1f1b5509689e03bf38d4fe48a9ba1897b1cb1078f32f793abd04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Appshapi.dll

Filesize
2.6MB

MD5
c770a9717785e435767cfe25745aec00

SHA1
ce8f95ef812ab4e6bc2526fa51b7cc393e5cec56

SHA256
d783cf5d8feb8e9d583c9f4c58da0edd241d49dcdc29a54ea7e69da74135521b

SHA512
c1e88c7d5cba233d01118e1114df735b61b06b625ac138cb1d27981d57785f419331ab9dbebf3049e854ad563e4fecb7073955cab3078fa174956640090366ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\AVComponent.dll

Filesize
137KB

MD5
97d80da804b153c4ba8d9132b19d99b8

SHA1
cd52d90e67afc4ac57aa3c9e15325c6942bdfc25

SHA256
077fad9e211e6c738299b4420d7d2479082ee64010a3c566303835fc1f61e573

SHA512
d6f965a49d340464a7dc9f28df2dcaaa52e8ae4485932338f246ace1bb75da60a4272dd0053323e7c49eb6ea949a29042407e7d20e9e3f50b1dbe65794cad374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\LWAAppshareViewerUI.dll

Filesize
56KB

MD5
83c34b16a929f6f486ceec17d706904e

SHA1
89ebb781e96bf00602210249164f90b8ea5deb69

SHA256
5d06000c14795bc82353cf0218e725740447b9a43ec3a053753360c1f90a6d5e

SHA512
547ce631f6d585ffc77cb1c2caf336e1535c259746199157fa8972723723ce2d915236e308ebc365de9d1812b211f7f0c5e50a6064d9c3809037a736624dbb62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\LWATuningWizard.dll

Filesize
135KB

MD5
7b30d87d60d1b641d15b2e0d90c9d8a1

SHA1
46c9cdcd45fc4b00e38ea657749705bd328817ae

SHA256
ed9754db9847335e5a3d27a2f389fb559ca623cb62d26323690f2dd92a9f8ec8

SHA512
f2829fbe73ca1d1d74ffa1d7bf1b8c9966cd0c6c91185d199dbc35a208518a4feb7b6847a439a53b4350c4cdb8b87119b4cd8aee8afb68cefcb6c634eed17db2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\LWAVideoUI.dll

Filesize
55KB

MD5
5be5d421c73edd9335cb86595c9359f8

SHA1
5cced891efd49c41d668ca94b53699c218ad29c6

SHA256
e1aa892807c79f6fdc1992ceb2c2d37d204c29a9e7c414d30c0b5ec991d69ded

SHA512
7c56e30156896e898cec357b39b6e1350106fd9640d3cb6240b739a041dc7296f9400383516f3cdbafc71d6f5bb700a03c8283dd6ac31d63afac6f7d4ebb110c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\LwaAppShare.dll

Filesize
399KB

MD5
5bdc9cf766e9cce9d00e78c76784ee1e

SHA1
366f754c7ac8724068ad32752d6628ac15046e41

SHA256
026a0f0417445f067b4ce57aa22bd4e21d4bf0845004e5027ed485f0fd89bc88

SHA512
3795781b0bca5c0cb33406d674f88fa6307dd7d20c625a125ea4691593803fe6cfe79ab893346aa138df5bbda92e3c9dcbec07476337b75a6d9e96f861329ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\MediaPlatformConfig.dll

Filesize
98KB

MD5
64f901235bee98c42552a1cf9fbcd036

SHA1
8d6564bc031b3d1f48cca06a392c43dcd0659bde

SHA256
3838c86f01c4059338ae560fb135e78d5fef9e13efa2ed9dad301a49cd61cefc

SHA512
13eb1b95d954377573110503d04e9008d36f91edfb816591b1125fef7978e366ad795a3488c055e50f80f0f140973af5ad6e7c1fe4769499949d73a887b280ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\Packager.dll

Filesize
73KB

MD5
460f1727d88edc4d31f4cb2c4e0a70b7

SHA1
a9baa2d67c180e2f7ad3470587d56e9037c6701e

SHA256
40a7f2a48404fcd0270e9703044cb1a4034ebdf705f9fb3d2baf72a65197f140

SHA512
63c3409f2c820b81b58da2d43812d443af74b2ec6b32b61266c99eced4b60273ab7239158b6e01e64ff658b71accb8b685e4c2d78883791e281d480d7b1bcd43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Components\Telemetry.dll

Filesize
41KB

MD5
7b2edf37b1a0e77c92859d3a5297fcb3

SHA1
6f9bf421fa2a75da039471b6e58d5d862c8da078

SHA256
fce8c5d0fc88869210c8376641ce63b05e60635571d140fca3fc85332f47f6eb

SHA512
2f9cdff21cf0f45e777ce6ce1f429c1d5bbf95c589ecfe4ac1f27e4169cf353eefa735525a526664345d1de034de3796ea6fce053da65514519108b56a4772b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\LWAPlugin.exe

Filesize
200KB

MD5
5e673522af17c6fc4e76a16528c2209c

SHA1
c08ea8fad441ade482737b1bf70c954fa5a3036d

SHA256
1cd468bd79ebad98a4a47ef44c74310715c366dff3061ba02ac2b508365cf722

SHA512
282e0221eb8b8fec5a2170b84fafd72e28c524b588ade059fd95b78d5be47424f8b239f4521bc8e68b2c9ebd9b5447ea56e365140d138ed8ce011ce92517ea0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\LWAPlugin.exe.manifest

Filesize
902B

MD5
cede11e98135211995b199686f4d020c

SHA1
0e1a2c5ac3ea85665c22146b69cf73b116a369d9

SHA256
f157242acf5f7a2d0105cb16f362329539e40883d695bfcaa4851f4219bace5e

SHA512
ca858bfdd26508d96f194c3417deabcae64a049288dc22eceb9d333bf79996f0efc0eba1d62f3744e0a11f7eca743425c58923032278e56229df974c9e79c105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\LWAPluginInProc.dll

Filesize
175KB

MD5
15bffb5196ae1f486e2e8ed64b378372

SHA1
5948ec838c2c01bcbb7a98ad3d1c0059ef7c03b5

SHA256
4117fc0a8838e80e1ef69c03b5c7d9d30327c80276697f242eca09e88bf194b5

SHA512
dd54cba9036c5a9227bf648cd1f1f0dd93cb396f14e414c21076dedf30092f609228d4c13e4e925faedb43fc2dc3cbe24f99459d22b48a9979201824898a9994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\LWAShell.exe

Filesize
292KB

MD5
5ca69fd7b6d9dc4f4b96110d3f895679

SHA1
9d3da2e898447ef251f2224c3679d255e4598576

SHA256
20591428d8544ecde62e7f1352a02950c5712834ce7ba5d5e1ed29c152b1cabd

SHA512
cefb97ad00be043234a6632d4fc12275e7cfc76360f100435f9a7c7ef149847ff7badc8476903329537a7769c34ed7357fc588a28835d532ca4ddec625195cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\LWAVersionPlugin.exe

Filesize
133KB

MD5
a10901be48aa83caf8bcfdb8769b6c3e

SHA1
39958c5ef14809bf058db4bd37d9ec9e3d8ed5e5

SHA256
36eead22a64441ca044705eabef7239e92a654f552b163abd9b52b6cdc33f53a

SHA512
c247d94541cddc73fd42832b68520add40538d30c2ea75f02bef5e68206c28fd82de4284b01d55b4b474e5674e4251ef723b676bf29e17c87bcf9e213dbabfc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Logger.dll

Filesize
38KB

MD5
a1ea9aef38b5e344a92b295636e356df

SHA1
43cb236d4ec81f5f049fd9f7144f39561c3ef7f1

SHA256
d0eeb8b3eac75bea5add99c9a45b959d855239fe53ae41388f0ad0762bb9ab1b

SHA512
1512ed58202576792c8c48ee45046b84d8f20888d3440ecae627e10a1c236afb1c0c5dce3be7f2245bfb3ea93aba06ce8acff506d03265f59634f7a54ffae2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\LwaASImageResource.dll

Filesize
249KB

MD5
55c9d6aebbf2eedf36265a46f3f9fbe4

SHA1
e933dd0701f29bcf8ec621447adbbb7434f40b98

SHA256
7e9807e54b4570850e7c6421e66258a36ddd0cc41487a2132e169f2619a45232

SHA512
2a187cc1c9ebeee8b7b6baf26752e2dfc4174958351e990f47cf2bcb5e20e8f0163f01f39f34148d1a9ec54f1f68974b79a033ca9e06905a67297f8e730ad316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\ar-SA\LWAPluginRes.dll

Filesize
24KB

MD5
042962570e5c4557a434bad4add30ce3

SHA1
dafc496538880541a95c31a6224d5ac8bb213ac5

SHA256
341cd18cd10dbe5f3dad684cd888690c28b0f6ebb45e004a6bb69b7268d813ce

SHA512
6975a7acaf764d6fe8aca74bf86441bbd15637a2b2ff35339bd8dc5e774dc82443fee37bc35903815e1664a95541690a4d8654668f376f8c9ecf34f5e6019949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\ar-SA\LwaAppShareResource.dll

Filesize
22KB

MD5
707223358836219cca99e3e01298a0fd

SHA1
59ae4a85456c554658934f2b1cb05d238180f883

SHA256
6f246de7a6f7958c283be176a50df181521fa725ba3e220faa65424dc4215cee

SHA512
b1f78a22e8c9acd609eedd98d3909e7a4b6746aa87e9531f396d61b3a8d1debc442199381310f8e3ef6b8d4674e3c2d9db3d47629646630071d7bcee6cbc44bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\az-Latn-AZ\LWAPluginRes.dll

Filesize
24KB

MD5
49188ea5e741301c54d00a6c3ef79e3c

SHA1
7e872f21b9c9a56ac1d71310e0e8b9330c3f10d3

SHA256
f4aa3123382deb351ad07e1db413adf4f95dc10f140250a6c34be11afecb928b

SHA512
3a9e944fd6671ec0b51cbf640c934163cd931a97c4ffbcfc9217e9ef09be0a53008da11dde61627641b683df7a452bb2c238b17990dd85ad27dafd2bd3868601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\az-Latn-AZ\LwaAppShareResource.dll

Filesize
22KB

MD5
70fa62d65b2463eb15cf157eacbf557b

SHA1
721ecd87a0e149e13baa3f8c16116cc97ecf3e27

SHA256
b8bbd1901c81b636c7b95203854dc1fc08434f77d96a33639fcc342527fb51e0

SHA512
d17bcd56d3b073567e2897c503a9dbd4213843b912b7643ded4bfbe881a44639b9f75a4719ffc1a20cc590f14abf191ccbababa9cd0af9140faff236fecc6968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\be-BY\LWAPluginRes.dll

Filesize
24KB

MD5
deaabb1f34fab2bd0f6bfc81b80de85a

SHA1
494130723e3292f2f8a8be7dc5ca5f5c72ce7709

SHA256
4d8aec82196f69667752c2973e8363a082a41eb4f176aae86c26997dba99e75e

SHA512
953e125d2e5ab681008792ac7ed2d4331b34f9dda48f49c1dea4dabebcbe2c3e15e085135c24ff428847b09fbdeb35fd76865a6dd5a7c27a884c1898d348a60c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\be-BY\LwaAppShareResource.dll

Filesize
22KB

MD5
f1b951e9e6bf94d46a9d0ce82c378fef

SHA1
6a2f488e733b0d9ac3a745e733751dc305a29f76

SHA256
4f4cff340654ee1851e8505626ac463d6ddc937693f32cd4f290f26483287dea

SHA512
7c9e6d44f9b9f9d7d0db75ef4707f76cae51239d6e2a54b172d3723a6a201cbce4eaae98176f4ed253bcbb341c402d4604610b7666ea24e0a2692cf9c4e064a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\bg-BG\LWAPluginRes.dll

Filesize
25KB

MD5
99f2a22cf0d3d7903c587aee84179f24

SHA1
151b2aaa5991b3d565c5d22fd244e7ca708336ac

SHA256
0e7d3756f842201e2fe17f4819b1a1ab129383f641b85f572a26c1317498df95

SHA512
c4d957c180b6e04381face12776fbb73ca581f7d68e0f509878da38a99f9420ae7dc7c6872cb39af3021e6b371caea688d7066fef6aaefda5aa042e35df4c535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\bg-BG\LwaAppShareResource.dll

Filesize
22KB

MD5
d0526b4caeea5b645aa1ab24afeea3b1

SHA1
0b918348b48c512d9a1951ba626eaf4c5170d275

SHA256
d99b36a8fba926119892f1951dead62cd671d65aa0298895a8d8c55722466e8f

SHA512
f5d24897bb016e13b56587b574088d27f7b1a92b5b5623e5b4eb9f2fea08a194210d96829bebc78a2110bb89901232c906380b0fd1879f2717b0d2abc72bc71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\ca-ES\LWAPluginRes.dll

Filesize
25KB

MD5
1bea7e6e6c1169b99b0cd156c8ed6455

SHA1
97e8c3ea22313a23bd9af7d50e00a6293f830948

SHA256
72296f4a869ee65717dd9a4b00c4d29b0a9c31079ae638074d1d3b5cea9a1d86

SHA512
91e41b7b06049b0a3a2349a5b0a00da294ba51d889f1456d97c97c0505853c06fee3b41065ac6f6a93796c6228c795e66d88d2e587739b1338fb37b5eaac1449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\ca-ES\LwaAppShareResource.dll

Filesize
22KB

MD5
6673b0775555626605d9695adee5c8a9

SHA1
d6dd85e48a5c89f296b2a350a89445fcdd5767ac

SHA256
479b5102a5004325fbca0b3fac030b7d7bd786ebb4993b6c9134ab8e7c43d1cf

SHA512
84371a016379929c6070a0b7b32e7ce209c57f17eb253782b38648d6aacbd61bc1f98b9ecd61e4f17fa9667478135b5a7d29e7a5c1982b43314d58ada54f2319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\cs-CZ\LWAPluginRes.dll

Filesize
25KB

MD5
e158f135fd1466a12b55b093d5d52d25

SHA1
05ec029866e99f927ae6bc9e383404ec6362fb2f

SHA256
608444e8336807e9aa49e12f225eab2b0a64c1524a456c8bf4ed77cef45a4ea2

SHA512
69096123187cc45072abee5786ed70c8f50ac01270217893758ca07ccb78bdd795660c13fa414c4cd139b5a63b6d22181b5180550c8f4c9060af0539a76090ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\cs-CZ\LwaAppShareResource.dll

Filesize
22KB

MD5
7eb4602b440186c30f6335ee44af6f37

SHA1
bf70731d4029ff682bccf9ef2326e8348b62ab2f

SHA256
b93c174a4fc10ccac5d3c2a3861390700b1d39b20659164a40310d436699129a

SHA512
50e13c01f0fd7478759a4080fd354572bffacbe52ed5ffc7f0aacf9c4fb81224d712c432bfd998134b2e774992176140232ba3eb291824479cd40b293e9a1ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\da-DK\LWAPluginRes.dll

Filesize
25KB

MD5
337c1db5eb028c67de7b92a110ea446e

SHA1
d07dea39d8e76ff52a8e265bbd8b3cb4fdc88ac2

SHA256
d5f49797a36bd39952a816d6886e6ea0b359cd89553929352745d7301bcd4634

SHA512
71c3b4307e7f61a15fb92797e95f12fb45056c40dc64e8e660aeab255c7900963910417e7e76a7c8f464901dc41f37f0bdbc81f6d782505f79783513455c02db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\da-DK\LwaAppShareResource.dll

Filesize
22KB

MD5
4b76f3d6a010f8ebd7aca7f813af92d8

SHA1
cf3e62b54dd1644c52f62e6744c6f2a795bc8a5b

SHA256
5e13c54ee252aa0261ce41c98b12f73a182a129e39b42f4405fd65ba390ebfdd

SHA512
32470eccffd32a9cf1b9e2fc9a0b5b21d5e8c81ab96317151078bf0d6cc9e82a6efaa84e2688dba3bad93649fab84a7fb9849a26545b1f77e487bdeb1573e3b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\de-DE\LWAPluginRes.dll

Filesize
25KB

MD5
929255297a22263a82b22fd0c68682a2

SHA1
7f279ae905939948899d62ad4fc71228574c40a6

SHA256
ac7b17a6823eb4bf7dbe8f48c36435ad1598a6b26ef54a93e3bd5e9e53295d6d

SHA512
af470438149bd80899865ef8356edea1cab6f0936ba49566d994368cbf8f92b020e63b1d489e7a57172c44106b408aab89ce050323b95441518ec953ec65d836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\de-DE\LwaAppShareResource.dll

Filesize
22KB

MD5
940cffb989c51dff2e6b750dcbc813bd

SHA1
b92342583d07dbeb1b1369631c63876727015b5c

SHA256
df31a9d3c64a3cdc1d32831a330b494ea977179724307d24a89f247d91409331

SHA512
bd2e9b620aa68e07cd06fd84442048e6046743695de1db4aa7912499c17ed2cd7e19cacd8e98d8fd4053dfedb013c0dfb61be2f111f7166e56a62ef67639ad05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\el-GR\LWAPluginRes.dll

Filesize
25KB

MD5
51594204529f84771cf3e0c329648804

SHA1
78d5f0965ccebe99efa2ebdd837f008a782becdf

SHA256
9850724135331da85a4b0106725b6af50d918bba153aa393a674e2974966f082

SHA512
125d33c76525c5dd56e1dba21c8ceb08a61a065a4aca5d3442e55162db94c7ad4aa8ef3ca842ec1bcd9ca68e7588991297d6f9935350b8bed6607a4c390bb425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\el-GR\LwaAppShareResource.dll

Filesize
22KB

MD5
e49c1dfd7345c1269a5423badcfd31ca

SHA1
597ff67f3924d32b52ab18912879582be8b9f971

SHA256
e5a39f4f63236c1f88ebf0fb894ce496114f7d2b05e684857e902a1a94f91803

SHA512
63e8345addbc17cfd265b83b99a64568aa12b44e43c796932819bf3beb021036288390a1d20901151c54edf95e3ee73525bb3d4022aae00b9c8452c6af66bdcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\en-US\LWAPluginRes.dll

Filesize
25KB

MD5
7fe25be4d030d8d9fc2656328a1c91cd

SHA1
1f7ae5e642bbf4b870a92d425ec98c6f6a4f5db7

SHA256
b90f2257212e0e17e5853168a84a5101e2e71c99ec4c6298494d5a2c0fa8232d

SHA512
0de71b10c6e9aa6a473b1faf3cd290575db199be7e84b56d9a5420f7ff1f92baea247f8aed74b160ad4a32c97c3356951e890419ed52b3d4de9889b5223f718a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\en-US\LwaAppShareResource.dll

Filesize
22KB

MD5
f9d529b319dba7c35147be86a64aa452

SHA1
82b4e580bf26568c7b1b55a01b9eb552402fad70

SHA256
cfcca597d09680b3ed24a4d6177b595e16ee4e557c11f627a2aa4c8d79caea8e

SHA512
a26d71bd4b791a531f3d00eacc2bbcd840f21335334ca0546ca892261c0581b401bda2312524325ddfd84b36094bde6aec18815567c209c7b530f6815cc36b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\es-ES\LWAPluginRes.dll

Filesize
25KB

MD5
36ef7e4b2a0e24aa4c7640ed8d0be106

SHA1
9257cbe0435030988039a1dd47c52579294f00ee

SHA256
1dd4f981f186e742556fae8a501da4b92dc6254d425f37c6764bdf52b79fb249

SHA512
a16574b1b868e33c5c96aefb9280d74742cc219b15d9ec6481d61a7867b8a870998fa6dc50852e2ce5027da8909cf25a3e75cc351a6632a60eaafd7d1c42f39f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\es-ES\LwaAppShareResource.dll

Filesize
22KB

MD5
094177d00f5e239fd1482fa8e57c3950

SHA1
2151effc3c60b021595c991760b237cdda676461

SHA256
459a22c101d79a17a86e929b8433ea4e920d92d73ecf38cb5453e8b3d72987f9

SHA512
67f30d6fc56b31b8c3e2f9f1b9158a515aece0dddd45a2024ab50cce2c66a748e65ff5e1b6db685ee0ddee3cf47ae5055f8aa7bcddc4ec8b26a7f29b618df9c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\et-EE\LWAPluginRes.dll

Filesize
25KB

MD5
bea5c2dd077583f2fb56cdd0930cc284

SHA1
c735a128db4da5d551b00b32ee9420a222b65209

SHA256
52d4d3633aed5d7182f0ea5a188c341c6239fe725defc150a5a7fabbd0808a4d

SHA512
23f057a54b2f13fe78361ece8490d4ab268a9f29d45ac74d3703b580f29657d07d6560bb18fada72ca14f8a4533605a3234b045fd33210dac4d885727e45b3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\Resources\et-EE\LwaAppShareResource.dll

Filesize
22KB

MD5
da0f75f0ac5cf52fc71575c130855529

SHA1
f234a03e75efaaabaa2ff6ce4d03d26816ed6d67

SHA256
f677ce1da10a1f71b8809afb1d3d8a7c6ef8545a5064eca2aabe4645a2942715

SHA512
f5ec7129640e41f73eadcf89adb16032ac8884133cfd2b000b7431f5c0810891c60e430c773bdaa23be5c8918f6b754a88a1c9c9e0e29696d7558990a89285db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\appshcom.dll

Filesize
287KB

MD5
e5986abcc78b6ce87e6becc53bf49241

SHA1
9a10483eeed7f03f10b0979c2afd1e8b7baf8cdc

SHA256
6616271cd077d5bd649725c0e3924a54e373b2dd6518b3cda9262d5f28cec38c

SHA512
d40c9eeacdcefcb01dc9de34b8a51d797dad40b649c5978078941e4dd4ab80b96d67ea534cce9f0c58d984f346f9c8c416e3b165bac37571921a68a9354b5680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\appshvw.dll

Filesize
2.9MB

MD5
5b2a87ea404118dd8b787e239c943684

SHA1
fd321a3c80e74d2a7e85f6d8a530c5f39d86ff92

SHA256
94331cb8086b89f38eabd09813dd7099fd1041c0504e06595be566c85351ad0a

SHA512
26a9cd09f1aac6fb9796bc21c730fcfd9324b4988e160b3013aa12d5a42e5f41e4ad251dd81695d587d9cdb57e20f5d5eff20b041b15baf58ad1f75f226d5699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\msvcp110.dll

Filesize
521KB

MD5
ab09ce954c647f3c2b4328b57d519996

SHA1
63f3de90362bba6f106367bac56566f952666d39

SHA256
0de1e28796f709d24758ddc6bc2c779f6ff4b20c51b163e2ba77fa7e52942070

SHA512
7c55060f782552d239500b9300c79c95726498fa7cf73250d22ae95ec0db1086b3012e19e066e3b0e9b22ae86bb5a8bb4ec2ed5cf2c03f2734bf2e58bef67fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\msvcr110.dll

Filesize
842KB

MD5
80e987dbe08677e2ec09615cd4358607

SHA1
d2109b7a238ae75545c7a43f863ead710b00b323

SHA256
8a06500612ce1bb0aecf052dcccce619c85be7732cbaeac4d6b26b6ae2cc7f7b

SHA512
cb876bcddb2abd97d247efca8fa602d9edf0b63fad12ebb1f4f3426e227b0a35f35db19cba2a51f4f8124df435fdcf8844728dc883ebf3662b20393958345a45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\LWAPlugin\x86\15.8\rdpqoemetrics.dll

Filesize
41KB

MD5
bc55515231e102b8050321c954451cd3

SHA1
7b16bd3e9371bc7bd6d251af22aaafece0413e4c

SHA256
7c0b3262154da8c08fdfe1c597d1fc95a6a93332e1f94c3d8d97e573ba63057d

SHA512
229824b434c84a968c33e9bc25940fe14d39e317f89b37228277ede5216add0c968294490fe4164f34608c668bdea8b0502ccb38f739b49b88a531871314237d

Download Submit
C:\Windows\Installer\MSI8707.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI8707.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI894A.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI894A.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI8B30.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI8B30.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI8B30.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI8D26.tmp

Filesize
163KB

MD5
430a42c955608402b59d94ea9f30608b

SHA1
a4d77bc9fa2e25f39fabbeeebeaa117317a632b2

SHA256
abaac65bf230854575ae77f60f898cd896a2653633e61521a5143eac27f6ba8a

SHA512
8faacecb59b714578303bbd4750a6b8d10a88863f43e461d896295daaed0352322a25cd16b6c15d1e6115da23cddce904d0c2ca602ddb7f38022390f7a71b378

Download Submit
C:\Windows\Installer\MSI8D26.tmp

Filesize
163KB

MD5
430a42c955608402b59d94ea9f30608b

SHA1
a4d77bc9fa2e25f39fabbeeebeaa117317a632b2

SHA256
abaac65bf230854575ae77f60f898cd896a2653633e61521a5143eac27f6ba8a

SHA512
8faacecb59b714578303bbd4750a6b8d10a88863f43e461d896295daaed0352322a25cd16b6c15d1e6115da23cddce904d0c2ca602ddb7f38022390f7a71b378

Download Submit
C:\Windows\Installer\MSI8E5F.tmp

Filesize
163KB

MD5
430a42c955608402b59d94ea9f30608b

SHA1
a4d77bc9fa2e25f39fabbeeebeaa117317a632b2

SHA256
abaac65bf230854575ae77f60f898cd896a2653633e61521a5143eac27f6ba8a

SHA512
8faacecb59b714578303bbd4750a6b8d10a88863f43e461d896295daaed0352322a25cd16b6c15d1e6115da23cddce904d0c2ca602ddb7f38022390f7a71b378

Download Submit
C:\Windows\Installer\MSI8E5F.tmp

Filesize
163KB

MD5
430a42c955608402b59d94ea9f30608b

SHA1
a4d77bc9fa2e25f39fabbeeebeaa117317a632b2

SHA256
abaac65bf230854575ae77f60f898cd896a2653633e61521a5143eac27f6ba8a

SHA512
8faacecb59b714578303bbd4750a6b8d10a88863f43e461d896295daaed0352322a25cd16b6c15d1e6115da23cddce904d0c2ca602ddb7f38022390f7a71b378

Download Submit
C:\Windows\Installer\MSI96FB.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI96FB.tmp

Filesize
78KB

MD5
1515803eefb94611d27d04ecc90bae2a

SHA1
07e2ab466aa5244cb6b7b71e7f2d29a3e2444749

SHA256
4bd8185d3d6a97b9dd93ddd89e6e0d760df07f25db28e378ac9c2d3c779ce763

SHA512
245933aaea752526adc5fd4b98b02569b8ffd81f7b355548ceb35ca6faeaf9f2279f0fedaf8c3b727663989c44b7d20a82f77b11a6644d029a1e6fae8d4c51bb

Download Submit
C:\Windows\Installer\MSI9798.tmp

Filesize
163KB

MD5
430a42c955608402b59d94ea9f30608b

SHA1
a4d77bc9fa2e25f39fabbeeebeaa117317a632b2

SHA256
abaac65bf230854575ae77f60f898cd896a2653633e61521a5143eac27f6ba8a

SHA512
8faacecb59b714578303bbd4750a6b8d10a88863f43e461d896295daaed0352322a25cd16b6c15d1e6115da23cddce904d0c2ca602ddb7f38022390f7a71b378

Download Submit
C:\Windows\Installer\MSI9798.tmp

Filesize
163KB

MD5
430a42c955608402b59d94ea9f30608b

SHA1
a4d77bc9fa2e25f39fabbeeebeaa117317a632b2

SHA256
abaac65bf230854575ae77f60f898cd896a2653633e61521a5143eac27f6ba8a

SHA512
8faacecb59b714578303bbd4750a6b8d10a88863f43e461d896295daaed0352322a25cd16b6c15d1e6115da23cddce904d0c2ca602ddb7f38022390f7a71b378

Download Submit
C:\Windows\Installer\MSI9798.tmp

Filesize
163KB

MD5
430a42c955608402b59d94ea9f30608b

SHA1
a4d77bc9fa2e25f39fabbeeebeaa117317a632b2

SHA256
abaac65bf230854575ae77f60f898cd896a2653633e61521a5143eac27f6ba8a

SHA512
8faacecb59b714578303bbd4750a6b8d10a88863f43e461d896295daaed0352322a25cd16b6c15d1e6115da23cddce904d0c2ca602ddb7f38022390f7a71b378

Download Submit
C:\Windows\Installer\e5685af.msi

Filesize
7.5MB

MD5
99a83e21b443353cb7e7af34fe9b2aca

SHA1
2ff2d7099606a4fbeec1adb9d80e7f4d46a74534

SHA256
deec97bb19aac63240ec1519358acd150eb22ad4c728d5566fb2255f8696019e

SHA512
0218afbd509f45d484edd5397bdee8a0e299b53298d40867fa284ae973d4b484082c7127cf1b0ebc65c815cb111df927ccb0055f5374056f6263e30683d9d975

Download Submit