8c0d64f0a9e3bea13f2c3aeafc670e62aaf396ba114c463c97e272464b4d8efb

Analysis

max time kernel
64s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

802010b.msi
Size

13.5MB
MD5

76b91e8a787b38027cbffe03d11f7382
SHA1

31c304a1f1ecc640152a9644ab8e495f49cdde38
SHA256

d56f51fce3ac02b3699a150044345f4e3cf268466d8cb53ba17b498fbac8fa85
SHA512

18ed23d2dbc8dcdce79625357415db2991fcc764f294a8f9563c651f6f71e7e88f841b91f92bb2a07bd44cb573ae7ded9f746048224af9e2b33a87777a2b985a
SSDEEP

196608:IaWD3aWyCPAbsBNGLJOUGpe7Ya1x1/pUU4pPElKRVZhGavapcAm:Iz7PAw2HEed9pUU4mKRVZhNvapT

Score

6^/10

persistence privilege_escalation

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2132	msiexec.exe
5	1620	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\TBMD4B9.tmp	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\TBMD4DA.tmp	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\TBMF52C.tmp	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\TBMF57D.tmp	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\TBMD662.tmp	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File created	C:\Windows\system32\TBMF52C.tmp	msiexec.exe
File created	C:\Windows\system32\TBMF57D.tmp	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office16\vNextDiag.ps1	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pidgenx.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\TBMD266.tmp	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll	msiexec.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms	msiexec.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	msiexec.exe

Drops file in Windows directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID9BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPOBJS.DLL.x64	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OSPPCEXT.DLL.x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPCEXT.DLL.x64	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a1de.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f77a1de.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9B9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OSPPC.DLL.x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPWMI.DLL.x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPOBJS_SPP_PLUGIN_MANIFEST_SIGNED.XRM_MS.x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPSVC.EXE.x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPOBJS_SPP_PLUGIN_MANIFEST_SIGNED.XRM_MS.x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPOBJS.DLL.x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPWMI.DLL.x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC72.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE3E.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPC.DLL.x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPSVC.EXE.x64	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OSPPC.DLL.x86	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OSPPCEXT.DLL.x86	msiexec.exe
File created	C:\Windows\Installer\f77a1db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPC.DLL.x64	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109A20000000100000000F01FEC\14.0.4763\OSPPCEXT.DLL.x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID894.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB77.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f77a1db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA28.tmp	msiexec.exe

Loads dropped DLL 64 IoCs

pid	Process
880	MsiExec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
880	MsiExec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1636	MsiExec.exe
1636	MsiExec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
2132	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_IMAGE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\LICLUA.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_IE_SHELLEXECUTE_CALLS\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_IE_SHELLEXECUTE_CALLS\LICLUA.EXE = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_SNIFFING\OSPPREARM.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_IE_SHELLEXECUTE_CALLS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_UNC_SAVEDFILECHECK\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\LICLUA.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SECURITYBAND\OSPPREARM.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ADDON_MANAGEMENT\OSPPSVC.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_OBJECT_CACHING	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_UNC_SAVEDFILECHECK\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\OSPPREARM.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_HANDLING\LICLUA.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_UNC_SAVEDFILECHECK\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONE_ELEVATION\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MIME_SNIFFING\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\OSPPSVC.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SECURITYBAND\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_OBJECT_CACHING\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\OSPPSVC.EXE = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_IMAGE\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SAFE_BINDTOOBJECT\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\OSPPREARM.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_OBJECT_CACHING\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION\LICLUA.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\OSPPSVC.EXE = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DISABLE_IE_SHELLEXECUTE_CALLS	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\OSPPSVC.EXE = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\LICLUA.EXE = "1"	msiexec.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OSPPWMI.OSppWmiProvider.1\ = "Office SPP WMI Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{803EDC90-F4C6-4B8D-BB5F-869EA2AF2B03}\TypeLib\Version = "1.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{033D10C1-80FA-40E2-B578-A800DF9A9316}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\Elevation\Enabled = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDDCFF16-3AEE-4883-BD91-0F3978640DFB}\1.0\FLAGS	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{033D10C1-80FA-40E2-B578-A800DF9A9316}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\OSPPWMI.OSppWmiProvider.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OSPPWMI.OSppWmiTokenActivationSigner.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{A4D51C5D-F8BF-46CC-92CC-2B34D2D89716}\10.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LicLua.LicLuaObject\CurVer\ = "LicLua.LicLuaObject.14"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{803EDC90-F4C6-4B8D-BB5F-869EA2AF2B03}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\Version	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OSPPWMI.OSppWmiProvider.1\CLSID\ = "{9E390D9E-7641-4819-BF38-8EEE08964681}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OSPPWMI.OSppWmiProvider\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{803EDC90-F4C6-4B8D-BB5F-869EA2AF2B03}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\LocalServer32\ = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\LICLUA.EXE\""	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EDDCFF16-3AEE-4883-BD91-0F3978640DFB}\1.0\0\win64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\ = "Office Licensing COM Server 16"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\LocalizedString = "@%CommonProgramFiles%\\Microsoft Shared\\Office16\\oregres.dll,-489"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\ = "Office SPP WMI Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\Version\ = "1.0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\Version	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\LicLua.LicLuaObject\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LicLua.LicLuaObject\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\TypeLib\ = "{A4D51C5D-F8BF-46CC-92CC-2B34D2D89716}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\LICLUA.EXE\AppId = "{1E886174-DC88-4B83-8BC5-66409EC75F16}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4D51C5D-F8BF-46CC-92CC-2B34D2D89716}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\LocalServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\LicLua.LicLuaObject.16\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4D51C5D-F8BF-46CC-92CC-2B34D2D89716}\10.0\ = "LicLuaLib"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OSPPWMI.OSppWmiProvider\CurVer\ = "OSPPWMI.OSppWmiProvider.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OSPPWMI.OSppWmiTokenActivationSigner	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OSPPWMI.OSppWmiTokenActivationSigner\CLSID\ = "{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\VersionIndependentProgID\ = "OSPPWMI.OSppWmiTokenActivationSigner"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{803EDC90-F4C6-4B8D-BB5F-869EA2AF2B03}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{033D10C1-80FA-40E2-B578-A800DF9A9316}\ProxyStubClsid	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\AccessPermission = 010004807000000080000000000000001400000002005c0004000000000014000700000001010000000000050a000000000014000300000001010000000000051200000000001800070000000102000000000005200000002002000000001400070000000101000000000005040000000102000000000005200000002002000001020000000000052000000020020000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1E886174-DC88-4B83-8BC5-66409EC75F16}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{033D10C1-80FA-40E2-B578-A800DF9A9316}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{033D10C1-80FA-40E2-B578-A800DF9A9316}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\VersionIndependentProgID\ = "OSPPWMI.OSppWmiProvider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E390D9E-7641-4819-BF38-8EEE08964681}\TypeLib\ = "{EDDCFF16-3AEE-4883-BD91-0F3978640DFB}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{803EDC90-F4C6-4B8D-BB5F-869EA2AF2B03}\TypeLib\ = "{EDDCFF16-3AEE-4883-BD91-0F3978640DFB}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\LicLua.LicLuaObject\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{033D10C1-80FA-40E2-B578-A800DF9A9316}\TypeLib\Version = "10.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A4D51C5D-F8BF-46CC-92CC-2B34D2D89716}\10.0\0\win64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OSPPWMI.OSppWmiProvider\ = "Office SPP WMI Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{803EDC90-F4C6-4B8D-BB5F-869EA2AF2B03}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{803EDC90-F4C6-4B8D-BB5F-869EA2AF2B03}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1E886174-DC88-4B83-8BC5-66409EC75F16}\VersionIndependentProgID	msiexec.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
1620	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe
2132	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeSecurityPrivilege	1620	msiexec.exe
Token: SeCreateTokenPrivilege	2132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2132	msiexec.exe
Token: SeLockMemoryPrivilege	2132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2132	msiexec.exe
Token: SeMachineAccountPrivilege	2132	msiexec.exe
Token: SeTcbPrivilege	2132	msiexec.exe
Token: SeSecurityPrivilege	2132	msiexec.exe
Token: SeTakeOwnershipPrivilege	2132	msiexec.exe
Token: SeLoadDriverPrivilege	2132	msiexec.exe
Token: SeSystemProfilePrivilege	2132	msiexec.exe
Token: SeSystemtimePrivilege	2132	msiexec.exe
Token: SeProfSingleProcessPrivilege	2132	msiexec.exe
Token: SeIncBasePriorityPrivilege	2132	msiexec.exe
Token: SeCreatePagefilePrivilege	2132	msiexec.exe
Token: SeCreatePermanentPrivilege	2132	msiexec.exe
Token: SeBackupPrivilege	2132	msiexec.exe
Token: SeRestorePrivilege	2132	msiexec.exe
Token: SeShutdownPrivilege	2132	msiexec.exe
Token: SeDebugPrivilege	2132	msiexec.exe
Token: SeAuditPrivilege	2132	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2132	msiexec.exe
Token: SeChangeNotifyPrivilege	2132	msiexec.exe
Token: SeRemoteShutdownPrivilege	2132	msiexec.exe
Token: SeUndockPrivilege	2132	msiexec.exe
Token: SeSyncAgentPrivilege	2132	msiexec.exe
Token: SeEnableDelegationPrivilege	2132	msiexec.exe
Token: SeManageVolumePrivilege	2132	msiexec.exe
Token: SeImpersonatePrivilege	2132	msiexec.exe
Token: SeCreateGlobalPrivilege	2132	msiexec.exe
Token: SeBackupPrivilege	304	vssvc.exe
Token: SeRestorePrivilege	304	vssvc.exe
Token: SeAuditPrivilege	304	vssvc.exe
Token: SeBackupPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1724	DrvInst.exe
Token: SeLoadDriverPrivilege	1724	DrvInst.exe
Token: SeLoadDriverPrivilege	1724	DrvInst.exe
Token: SeLoadDriverPrivilege	1724	DrvInst.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe
Token: SeTakeOwnershipPrivilege	1620	msiexec.exe
Token: SeRestorePrivilege	1620	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2132	msiexec.exe
2132	msiexec.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 880	1620	msiexec.exe	35
PID 1620 wrote to memory of 880	1620	msiexec.exe	35
PID 1620 wrote to memory of 880	1620	msiexec.exe	35
PID 1620 wrote to memory of 880	1620	msiexec.exe	35
PID 1620 wrote to memory of 880	1620	msiexec.exe	35
PID 1620 wrote to memory of 1636	1620	msiexec.exe	36
PID 1620 wrote to memory of 1636	1620	msiexec.exe	36
PID 1620 wrote to memory of 1636	1620	msiexec.exe	36
PID 1620 wrote to memory of 1636	1620	msiexec.exe	36
PID 1620 wrote to memory of 1636	1620	msiexec.exe	36

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\802010b.msi
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2132

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 2EE986183C995624A55724B71ADB49D0
  2⤵
  - Loads dropped DLL
  PID:880
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 3F46C751D08CFC2720CCB2294EC05F17 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:304

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003BC" "0000000000000594"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL

Filesize
175KB

MD5
28ddca0021ac200864248e02ef9727e2

SHA1
448a10b98ef39a67065f22e11504956863ca00e9

SHA256
d0b8edcddffec9b4b8a68eaba25c5d8754c9d19bd2c3fc708df4008f6540d91a

SHA512
2ea74248ad71d39722cd3e5bf116849754280a8914a162c4dab2a568f61a3feb8babaa6d022fa6eee7aafb0fd36baf0859d8322eb71df8d22dad5262daf4ea36

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL

Filesize
1.6MB

MD5
6839d36cf03874cbac7c685e56e21c67

SHA1
7be420091d394ea8db9334bc8356a624ab75637b

SHA256
52a372d6935472e4225c37d1c038390f1e14b6d177c35ff93a9562144014a396

SHA512
bf5a88355d272613889f3600cb5cd1667f592ca472ca956eddf8024a0f2947469efe697e42fd9757d7a40d93128dd3d46db38ee9cdb66a287d03130d20ee9376

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL

Filesize
199KB

MD5
2b26eb559943b3e47cacd3099b6aec93

SHA1
70c1f5a5ab23b9a5cb25957676b72db856618932

SHA256
2d6514afda6287fe1b26c28245381c0e3d0e9ff38ef621e37daa242d60cad9a5

SHA512
4f880dbca2630681fc62bf70d2a5ad00816c6c3a7f15c3cce8f3b95329c7b3c35e504409d2cb0d7696b087eb89fe77339afd6f982079d7da2800e7e10959601a

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL

Filesize
2.1MB

MD5
10ecc3712b8028edda60c8d5d449f52d

SHA1
c9b9b830e7a795422aa1738c3a41e9f55a723681

SHA256
68bb878127b1a669c39701285ea06787b1d4c77a110080b68fb6a3548ceb760b

SHA512
919e7924d1b8f00113adbec8d912b6f381b3ee7df85699fa9e64135638a694008da567e64984f425520d58e3f7e8d8bb328dc772a24837825345e5ead36227cc

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Filesize
4.9MB

MD5
fe9c0029e1af26350d9985d00520e5c8

SHA1
9a94a35de6543d9b63bf051654f87d0efc3616be

SHA256
967079ccf7b2cbd4b48c9f076675c26af93a1cec26c96811f279414e34004ee6

SHA512
4aae7f5ac467e867a9435f22379a5fde47393dd1368168ca75b83d25da7757d752c15aa51947a2a3435a107c1b75596f73725f746d9db90f599de412024e04ba

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL

Filesize
143KB

MD5
b952cc985b9f7b0fbf333ffbdd891ad8

SHA1
9b70bf0a7ebc265d708f770f5fc532f501bcb263

SHA256
cbec828ff4eba6268366a04e55058702f9cee6fbca0d6c6faf4f739b32a060f4

SHA512
7168cc84c21d73d402201de4b11f3d626fc0ef57ab678deddaa0d5045c4bfe746eebf7e5a59bbc1791d9a20cf0eb3e68525c2a494021f2a0f9277537ddd35139

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF

Filesize
46KB

MD5
a395fd62ca91d07cd8fbd32e8281cb1b

SHA1
11131b4596cda84df50c5deeba3beb5e16568e99

SHA256
3b2d79c078fb9e61966e09bd35223e4725e10380830a54f2b25f906cfc7f0d26

SHA512
dd77b2fa53b95f9f18a818bab9bd3a8895b3313f80d7dcbaa69fdb23038b553e06a907406897452b5efdfc92201dd0d7b9a9456b0694e3730c5a949418111595

Download Submit
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms

Filesize
9KB

MD5
b865a01ab8e8c0d088af43b6294b1aa7

SHA1
566b6b49a4c8280d241f08138e0e86a1337c17c5

SHA256
1f4ece64f691bff49c92b2839eef70c45fe7e527a5f601e67ee443ecfd325a1b

SHA512
9dee6fb008f6d5baf602a0739546517c625015020275819daf12ad45889e596f584f6dc3f54221a73b953c868a232ebdc48588edd96667ecccc96f17b23eff7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2600d820cb12af3b598dec0d1559ba11

SHA1
21982eba941688b96b836afff5f8b7e5f36c326a

SHA256
e111f227794807ec7c1c98f535f594b6847d2ad6f4819947979a2fe243e53627

SHA512
4aedb5fcde49bbe04680bc6a7b052df6711b4306e5db5e65edd723aa5c2cb9c03d25414d80106fe91ceac7c424664fc12a8a44387e68f5454d92d4a253839eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AB2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Installer\MSID9BE.tmp

Filesize
1.3MB

MD5
b7a37dfe737e06774c02c91d15d0f60e

SHA1
e09c7081bb73c26f487d81a0d8a46fd50b0959e3

SHA256
a0450e961879640b6ce87d69fd4c3583b72193ed8c24eb7f6593c42db679eaae

SHA512
d94f118f1b6f8a6607bb1a233d1000f3ffd4a2c07b8970a312ca0f877df4897e4266fdff55104c17ede44b02e5eb2a4bd5bc7cc656154916da77926d641dd089

Download Submit
C:\Windows\SysWOW64\concrt140.dll

Filesize
251KB

MD5
3d0ea6ba3551aec4717ab2827319a741

SHA1
e1273ba1b3d6cdbf93c99b115ef8accd84568718

SHA256
1573721c06f70d779f5aeba175c039202069da15d8526c3ce0c19b8c7fa985b1

SHA512
bade3d768bf435c0add77ba377866a59146d22e102932fbeab08fc10b27b9f5bcc5375ed26ee48847fb57649d706ff2ad6192895780c6924e34caa7fcca3514a

Download Submit
C:\Windows\SysWOW64\msvcp140.dll

Filesize
436KB

MD5
c766ca0482dfe588576074b9ed467e38

SHA1
5ac975ccce81399218ab0dd27a3effc5b702005e

SHA256
85aa8c8ab4cbf1ff9ae5c7bde1bf6da2e18a570e36e2d870b88536b8658c5ba8

SHA512
ee36bc949d627b06f11725117d568f9cf1a4d345a939d9b4c46040e96c84159fa741637ef3d73ed2d01df988de59a573c3574308731402eb52bae2329d7bddac

Download Submit
C:\Windows\SysWOW64\msvcp140_1.dll

Filesize
32KB

MD5
b262a68778d6117d77dfd88a7f43ca44

SHA1
839de1d7bcfb4d91736707194b5f94bff9285afc

SHA256
a7ed4a417f0c50578f2ca2c5106004dd82f78dd3658a852b37147fc362716667

SHA512
4f417d12a86d19773d47bdd50d97bf975eaddf1dbbdff72ea6ea9ba164e47503cd4bb4ffd9c308567ec1ce0a23c024c24bd8647aafb68cec4f747ce668296e28

Download Submit
C:\Windows\SysWOW64\msvcp140_2.dll

Filesize
245KB

MD5
60bf20c3cc7a98169465cd85ee833d67

SHA1
d562fd487cdba1eebad05d39df4e143acd9a50f1

SHA256
3eee52d6389e9f12fa38f71247656c414ba675a96f7fa9987ed598f5963711db

SHA512
d7a7859a86eecaadfdf6f5001595a331f5fdec16112c5b9b6a314eb55c9ef49966a74f45e4eaa9912b0f2fd76e867c2aaad4698b396989eb6532afe53e4e8f67

Download Submit
C:\Windows\SysWOW64\msvcp140_atomic_wait.dll

Filesize
45KB

MD5
c1ff4738f68a0570720f695b5a4837b9

SHA1
c7ba41ba8049409d2ea5a3b4dabc2499837cd60f

SHA256
1b940ce6e0791b41538f475ff97fcd04156c2cab924557199b57736d7ea510d5

SHA512
edb1fd8efb8b45474f43472a88a404329c0e756e1efd9f3fb1ef2c800cdf64ba705cc7a339650cf0e2978e8d38fe42a16ccc86faaf6630986e3e2e01bb03e632

Download Submit
C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll

Filesize
29KB

MD5
d90414f90993f195846c25140d47566b

SHA1
3d3ef684d63bc62eef8cbe09eaf0ee88159fc17c

SHA256
af5645d93635823702f00e12c0c8d68eea5d2f20edcebfdcf5e076e50a9cb64a

SHA512
bd4d3e4681d766449f743a924783154a5916a85ffb72f2f0ef43ebbf8380869d58ced6f56e31534f8b70febd4ef5de47a9b1760478966c5d26accd7173fde45f

Download Submit
C:\Windows\SysWOW64\vccorlib140.dll

Filesize
278KB

MD5
934c75adff9036378fd34f526c6641a1

SHA1
0b9572ebe4fc49ef2def824327efcaf9c9b90daf

SHA256
b4652ed190eebf59d4ca8bb340cadfbcfbb7a32abb893d57ac49b1f22cfa0861

SHA512
a00b1bf0f10437a680c332e2fce287c194b3cf666e985acf047cebe755596b15f99bad5252b6a2244ae8805e24218aca2a898e63c28ccf515d75232410add6e2

Download Submit
C:\Windows\SysWOW64\vcruntime140.dll

Filesize
88KB

MD5
9c133b18fa9ed96e1aeb2da66e4a4f2b

SHA1
238d34dbd80501b580587e330d4405505d5e80f2

SHA256
c7d9dfddbe68cf7c6f0b595690e31a26df4780f465d2b90b5f400f2d8d788512

SHA512
d2d588f9940e7e623022adebebdc5af68421a8c1024177189d11df45481d7bfed16400958e67454c84ba97f0020da559a8dae2ec41950dc07e629b0fd4752e2f

Download Submit
C:\Windows\System32\msvcp140_1.dll

Filesize
35KB

MD5
7b0a25eee764d8747f02cb3ed980f07a

SHA1
9b9c827f8c6e7f497e88b83f0654bdf97c50c50f

SHA256
1274292f4cc655f295272b37e08a9683b8bb8c419b61ea2e1f43eb4d22f02f90

SHA512
3302ee0c62947f3eddacbed0ae14f531de24392e2c73b40ab9690e6be5f869c3b525a27868a4507e7e80ec5da68b71880731a6b105e16173baa65c770f2666a7

Download Submit
C:\Windows\System32\msvcp140_2.dll

Filesize
262KB

MD5
aa0148e20d34c10e01a4a9e1bab1d058

SHA1
d58a5e3d76403ee5a65a07201aa8a2fad1a173d2

SHA256
583ad842bcf2f77af57d07b8f00eca77bb2df763df96bb9c50f7e52031b54e42

SHA512
2711a4ca8f387338dc97da065d75fe602255cf6e0d1f60c3749311e090abe4ea852e951c3c6e6350b8f742c4b88facb22ab0959d9047b0507c3bf050782385f4

Download Submit
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL

Filesize
145KB

MD5
8c362bc4687838891922dbd00d622acd

SHA1
baa7b4fba6519d3f3d3da305e7fcab31f1ec8051

SHA256
383ff92cf608b77a1e5e24d65f2089d8b22c1594b58f0f86994322586fe5cede

SHA512
3504c0097400fc05591e275e64aeba899a2a9def68e2313b6b73d9185bf8683d991bdafc79c1d9e74ac897d11c907c254d44817e100ac9e17c3ab55d0d5e90f4

Download Submit
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL

Filesize
1.7MB

MD5
0ef845af06ae5f34ba8f9b397a98be3a

SHA1
585837231487c537648f75a9282daf8bd6fcb76e

SHA256
94b1bfeea829bd99768126e2f6cbbcbe13b46fc67b1ea0b6f01edd817d779d51

SHA512
a6cc8041a0c785afd521b38558076f98ba5b8652110e7f28a228182f5e2156ac99d0b9e5976500ad0fc63cb4d04b309a44827c30da91680ac442a5d626e1920e

Download Submit
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL

Filesize
142KB

MD5
17e8de51c5dae58c5c390f41b9c777bd

SHA1
f607f859c694d2927a6f6b69fd587b6b0979873e

SHA256
c3a8886ed48b2339ed106c503aa05e183905e21d0f504645efb4092aca8d459a

SHA512
570df5f541a9ae8c0ffc8df730d805a573abc15c3aae5b208d5d3a8b0bba760830358916b0d64eb7964e7c062b4eba0b955ea78296ee5a04ff2b48d4de489fc8

Download Submit
\Windows\Installer\MSICA28.tmp

Filesize
393KB

MD5
533bc5aadced0a64a0a56f22bc0a9b28

SHA1
4b6143a5273191da6132e714d61efab4f650b213

SHA256
103f26d654146990b8008ca1f0d0940cb41740960e9bbe6a0782db1b70b75f93

SHA512
b7043e957b55ffdde055669201ffcc84d1afb26e3d9d9c2bd3ad4e0f332f2fc57db7c3487cec75a0b04bd76b274c3c85b57d6b53aa56382098bb677c34ef5e6f

Download Submit
\Windows\System32\concrt140.dll

Filesize
308KB

MD5
0b42ac3aff1633b0d7edb9fdf5e4ecd6

SHA1
2ca2129c8bbcbabc4e21368a6f9acf59a64d33fe

SHA256
5b757f98a5f3e4ab8b944067c12bec9d67a80aa31c7de702b15dbd199dd602ed

SHA512
afc8942f002ec2958eafebbbeb4b30c47c3e286c387322c4be8839b56f9a1621d556d8cb93caee6ece8bcbd1b99c96972a562b758080c183c27762b5a2acbee7

Download Submit
\Windows\System32\msvcp140.dll

Filesize
554KB

MD5
c7a693fcffcb6c245282d1132e38ac5b

SHA1
8965f69c938eecb2226ad7329a9df5109d93cb8c

SHA256
a8102891d06b5f21c35c67e4ab26eb84f54405b67e67eaf75dadc62cef08b55a

SHA512
321456ae04eb392734a0aba27e965500467d58dc1277fc550b6573916607ba53c686db05219ce326fb3f9289cc4430b85990362f630e4a7829345067986ca6d2

Download Submit
\Windows\System32\msvcp140_1.dll

Filesize
23KB

MD5
1dd99e6af2a3540646178c6cff4bb1a3

SHA1
e6ee44e1757eeefcaeec0a8b59bf26924ba7115e

SHA256
3b863fdbaf3d8743f49f9582c7424abe82874859752c89a5dbfe410682e0df21

SHA512
77f52f97263cb596e3acddeec96462e5c7d037efb3c99d88799e195fed971e85faf765b02a44049296e41bb7a61485201fb39675cca926f5bc0ed9713facfac8

Download Submit
\Windows\System32\msvcp140_2.dll

Filesize
181KB

MD5
4e15ae636bda43111ce456ae0f28c535

SHA1
c84ef65fbc8fafa30cf5963658e9bd05f6ed1944

SHA256
5bda82dffa3e617808bc32c00918bcde8e6a4ee7648bc362a477549c86dec907

SHA512
244eeaf63af0e87395bf4e1bb1bf752b4501450b3cf172debe8844aa94cf77ccd1906d3c2faf9ed8c1827eb4be3ad4f2486276e44a9987e872ac026d57df46b6

Download Submit
\Windows\System32\msvcp140_atomic_wait.dll

Filesize
54KB

MD5
3e57edd976b8c200d53eaf6f065abec1

SHA1
14bfc824f1c2c5372a04d84b757418bdbb8f43e4

SHA256
c4ed383a021518c99e94cba9367a155aba1ce394f4423d02d2a52953ac3ee154

SHA512
3cc77094fbfb0e426fc11edc01242b59c3c980cc59f3bd74ae050fb349f378f167b8edb7541b46fa554963d85395fe493f5ac2c620f301dec3647c554a80e8ac

Download Submit
\Windows\System32\msvcp140_atomic_wait.dll

Filesize
49KB

MD5
6722344b74084d0af629283060716bae

SHA1
36aa8ef02d3a308464c1ee8f75d6d118314202a0

SHA256
c9fd25862b1b8b2977bf188a4e0c4460dade43c31710283c2b42dbd3b15b4317

SHA512
1f844bfff36a7ec0cc3a04b5c88248d952c6c38b7048ae92dea3ffd8670c8b1c412ad44f2501816f6b80bca9d5bb8a06cd920d4682bb52f08ef66a8a1d826405

Download Submit
\Windows\System32\msvcp140_codecvt_ids.dll

Filesize
19KB

MD5
3dd7dd018d9ef510b571068562d439ab

SHA1
e78d09f5b5a2f92d2af52d52ed40efeb28920680

SHA256
5baa6445b21d07ce183144cc2a997d17892dbe38d7fe3acdcfb37e081d41eb17

SHA512
a6e430da3fa92715461f21d7e48bd5002cd16ab9f9827304cd789ce8e615b123f0e377958b1a49ac85ca1c15147f9cbaa9656b1322a853cd51e748da1a4973de

Download Submit
\Windows\System32\msvcp140_codecvt_ids.dll

Filesize
31KB

MD5
165308ee66d0b8f11ca20f3bcd410ea9

SHA1
510969622b7f3c92c152ecfdc5ff08edefcb9594

SHA256
08df3ab1b59d1f7d63f0811838e4fccc107087fcbc469d94975c0e44477058e7

SHA512
10b98ba3e0c75519e661cf6fae1797acefea6f5fd48076c3e8c6ba26fe7f3b214bb0ab4f5b74f937d3ce91d65ff2b9aba1fa584114be924580283948862d8d78

Download Submit
\Windows\System32\vccorlib140.dll

Filesize
327KB

MD5
06167b46ff993f09d93d876cd343082c

SHA1
78433956ad807a292757fefb41bca7b54ff1a7df

SHA256
612830ea96814be2501a171b9065b672efff21c117276cdf11994830c1dd3b2b

SHA512
6b3cc4795423ce108d2f721d1ef29ff799d6edd9cec5d41c8d67d99053ba26179e2644ca7ad922e62cf375f65fdef7a1f4e7986a1200e12719088d31268d4d9c

Download Submit
\Windows\System32\vcruntime140.dll

Filesize
94KB

MD5
6e34fc4a713c3fbd88e47ac188d2540d

SHA1
1877a17da406d147566168c56aac1eb576782b37

SHA256
d8faf8ebf360ed0b3b1a43877a04863f7e044b3d19b641d88737e0829d683b36

SHA512
848a1d9602210d7da0f6e4d7817af08dc02baac7eccf1cfaadaf3a24b55e1316e77c40672a6a1195797e525f448817e534ae200e99cdf548ee64a7996fbcec4f

Download Submit
\Windows\System32\vcruntime140.dll

Filesize
116KB

MD5
e9b690fbe5c4b96871214379659dd928

SHA1
c199a4beac341abc218257080b741ada0fadecaf

SHA256
a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8

SHA512
00cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c

Download Submit
\Windows\System32\vcruntime140_1.dll

Filesize
36KB

MD5
d76532f224b6648179b77525326e8754

SHA1
cb0a90adf84b9c19e750b166789452693f031053

SHA256
0d8217dbb0d52a3f8cd233b089131ca19aa6e0fc0c0fb10081f3c50761f5d15e

SHA512
721b4f0f55fbeefa394d3471c66d32e2f0f452f9977987450b1662b8e2e9a88d1b9c014b5f2a4b378d99f6fe4de6b5810f8b00157ae25b0de2a3bf3e211ea2fc

Download Submit
\Windows\System32\vcruntime140_1.dll

Filesize
48KB

MD5
eb49c1d33b41eb49dfed58aafa9b9a8f

SHA1
61786eb9f3f996d85a5f5eea4c555093dd0daab6

SHA256
6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e

SHA512
d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6

Download Submit