750f304fdc796497d448f581cc69835875540dd03c5422efc2f7db4d2a507623

Analysis

max time kernel
133s
max time network
92s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Office2010Toolkit.exe
Size

30.4MB
MD5

095da47b2af35235a9dce6a3a0b8b7bc
SHA1

79c1e905b760f04b57d27fdcad6bae00092627a7
SHA256

750f304fdc796497d448f581cc69835875540dd03c5422efc2f7db4d2a507623
SHA512

073b54303e188e0d7ffa3b6016e566c3e182ef4ea468367c92c5bcd57058fc1dbb9e1ce8de33aa5fcb52ee1ed92e468f165a50511f0ed8595b029b627cd2a1eb
SSDEEP

393216:9BicMNQk9lhCOlF8ecgUv22AJDPUecfmJjO:6GanCAF8ex+HAx8Lu

Score

8^/10

adware defense_evasion discovery macro macro_on_action persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	msiexec.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-0011-0000-0000-0000000FF1CE}.msi	office_macro_on_action

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Executes dropped EXE 2 IoCs

Processes:

MSOHTMED.EXEose00001.exe

pid process

2644 MSOHTMED.EXE
1736 ose00001.exe

pid	process
2644	MSOHTMED.EXE
1736	ose00001.exe

Loads dropped DLL 53 IoCs

Processes:

setup.exeMsiExec.exeMsiExec.exemsiexec.exeMsiExec.exeMsiExec.exeMsiExec.exeose.exeMsiExec.exe

pid	process
924	setup.exe
924	setup.exe
2164	MsiExec.exe
2164	MsiExec.exe
2164	MsiExec.exe
2164	MsiExec.exe
2164	MsiExec.exe
2164	MsiExec.exe
2164	MsiExec.exe
1180	MsiExec.exe
1180	MsiExec.exe
1972	msiexec.exe
2584	MsiExec.exe
2584	MsiExec.exe
1180	MsiExec.exe
1180	MsiExec.exe
2584	MsiExec.exe
2584	MsiExec.exe
2584	MsiExec.exe
2164	MsiExec.exe
2164	MsiExec.exe
2888	MsiExec.exe
2888	MsiExec.exe
2888	MsiExec.exe
2888	MsiExec.exe
2888	MsiExec.exe
2888	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
812	ose.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
1992	MsiExec.exe
2888	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

msiexec.exe

description ioc process

File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

Processes:

msiexec.exe

description	ioc	process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\TEXTCONV\RECOVR32.CNV	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNOteFilter.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\1033\STINTL.DLL.IDX_DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_COL.HXT	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanLetter.Dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_F_COL.HXK	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieLetter.dotx	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG.HXS	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_COL.HXC	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\GRPHFLT\MS.PNG	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieResume.dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Modern.dotx	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OCLTINT.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_COL.HXT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\ALRTINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianMergeLetter.Dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginMergeLetter.Dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\GRPHFLT\MS.WPG	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EXPTOOWS.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OIS_K_COL.HXK	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\wxpr.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Office Word 2003 Look.dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_COL.HXC	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Custom.propdesc	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNoteNames.gpd	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\PHONE.XML	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Smart Tag\LISTS\1033\STOCKS.DAT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendtoOneNoteFilter.gpd	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.DLL.IDX_DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\1046\hxdsui.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\CERTINTL.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\MedianFax.Dotx	msiexec.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRLEX.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Help\3082\hxdsui.dll	msiexec.exe

Drops file in Windows directory 58 IoCs

Processes:

msiexec.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIC1D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7906f8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID398.tmp	msiexec.exe
File created	C:\Windows\Installer\f7906f8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB97.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID23F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1B3.tmp	msiexec.exe
File created	C:\Windows\Installer\f7906b5.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\f7906b5.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI722.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E6B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA252.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1F3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8DE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9135.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C37.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI16F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7906b8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E1C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC133.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9571.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB627.tmp	msiexec.exe
File created	C:\Windows\Installer\f7907bd.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI122E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92DE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8B9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\ShellUI.MST	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7EF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC182.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F51.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI932D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9959.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF60.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICF71.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8E94.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB107.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI46F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC0D3.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI15C8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI92BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI961D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\Installer\f7906b8.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC084.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI13A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIADDB.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

setup.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeose.exeMsiExec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ose.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exeMSOHTMED.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F7629763-7562-4d3a-8468-6CA5563852B2}	msiexec.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2F	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMSOHTMED.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Groove.ItemType_Invitation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F42B9186-09C8-3B8F-85F5-7071A0ADD127}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6EC6B31B-AA8E-31A3-8211-3ADB9601AC42}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1E1C4C4B-742D-40CA-8DD8-6E9B772D117D}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00004109B10090400000000000F01FEC\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B06E961-E47C-11CD-8701-00AA003F0F07}\InprocServer32\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3B06E965-E47C-11CD-8701-00AA003F0F07}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{26DFB74E-52BE-3CCE-95DA-088D8856AB05}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{71B3341E-3DFB-44DA-9C20-F2CA8865517E}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MAPI/IPM.Appointment\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9160E22-BDF3-4D8A-818C-D99D10EC7BEF}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7398AAFD-6527-48C7-95B7-BEABACD1CA3F}\InprocServer32\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{80EB5D8F-AF97-3E3F-9EBD-1B1C645CBCC4}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1BEA23A4-497F-44D7-B7D8-80EB71A02FB5}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2332F625-5996-3534-94B7-8CDA760A3314}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1EC70558-BDD6-4831-91DA-9555F03BE3B6}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00004109A20000000100000000F01FEC\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\Version	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8E14EF4B-C532-3446-9EEC-19690CBC66C8}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D40D9DE-2821-44A8-BAF3-8011E362CF59}\InprocServer32\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TaskLaunch.TaskLauncher	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{384D0656-2A34-36FC-AC92-F2FB3072D0F8}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C7D9681C-4F5C-3840-BFCE-C91510B56181}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{12B55737-A883-42FF-B5F7-D7360E7B97B4}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8472D0A9-03EA-3253-8BC8-F66718CF09A6}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4AC9EBAD-7C25-4F25-957C-1B9C17F671D9}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{33D8EE1C-9A95-4151-8D85-ABAAA9DFF429}\14.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE0A0A1-96D0-4B04-8EC6-2DBF9BD888DC}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{577F8B82-4D9C-3461-9045-C379319A9185}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6353E18A-0C88-3DA4-A61D-298C8564DD1B}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D569CCEA-6168-3997-BD18-51FA2E56D16F}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{4373A87D-5066-4A00-9AC2-7A7285C9C44F}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DDAFA8B9-3BBB-4679-8D6C-8701B9F234E2}	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\10CF97668EC18004B8CF607FA7924D3E\1033 = 780062002700420056004b002800380041002400210021002100210021004d004b004b0053006b0045005800430045004c00460069006c006500730049006e0074006c005f0031003000330033003e004a00420053004e00700054004800650029003f0064006d005b0030006200580026002b003d0078000000780062002700420056004d002800380041002400210021002100210021004d004b004b0053006b0045007800630065006c0043006f006e007600650072007400650072003100320049006e0074006c005f0031003000330033003e004a00420053004e00700054004800650029003f0064006d005b0030006200580026002b003d00780000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{750D0562-9930-40dd-9DA7-887B50F2111F}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F051-0000-0000-C000-000000000046}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\00004100E60000000000000000F01FEC	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C514A18E-862A-45d3-8A5E-62CF54D912B6}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{34228EDD-27B7-3C0F-914C-C8D17F56346B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{513ED69A-DABF-356E-8963-0F7B59D88371}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50D56610-60AC-11CF-82C9-00AA004B9FE6}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E3D0438D-D284-31C5-A2BF-A4AF6A1BD014}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DCAB0EF6-C2C5-30B2-BF9C-D38F2A65C630}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A1736625-6C96-3273-A423-BC03D412AF89}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D6166973-3665-4EDB-94B0-77C65C34B51C}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E187-0000-0000-C000-000000000046}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{8ABD339D-A816-3EAD-8BC9-B9544D519AD7}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1BEA23A4-497F-44D7-B7D8-80EB71A02FB5}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MAPI/Folder	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1E795768-6E5C-3CF7-AACB-4CDE284B7B04}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{19B25EA5-F83D-3EC9-9303-96E50B3E7BDC}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{5269BEA5-B268-3A80-9BDC-BE3B37446510}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{927D5C5E-9E3B-46E0-AE7B-3E89A0B53FF7}\14.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{14C73C30-1612-11CE-9E98-00AA00574A4F}\11.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\COMMAND	MSOHTMED.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{0F05520A-75C5-378A-A3B8-E7B89539F932}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9C1DBE08-4499-311E-B83E-27B844624F91}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E4E5B4E7-B80E-3791-A642-F574F355AE9A}\14.0.0.0	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

1972 msiexec.exe
1972 msiexec.exe

pid	process
1972	msiexec.exe
1972	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeDrvInst.exesetup.exemsiexec.exe

description	pid	process
Token: SeBackupPrivilege	2404	vssvc.exe
Token: SeRestorePrivilege	2404	vssvc.exe
Token: SeAuditPrivilege	2404	vssvc.exe
Token: SeRestorePrivilege	560	DrvInst.exe
Token: SeRestorePrivilege	560	DrvInst.exe
Token: SeRestorePrivilege	560	DrvInst.exe
Token: SeRestorePrivilege	560	DrvInst.exe
Token: SeRestorePrivilege	560	DrvInst.exe
Token: SeRestorePrivilege	560	DrvInst.exe
Token: SeRestorePrivilege	560	DrvInst.exe
Token: SeLoadDriverPrivilege	560	DrvInst.exe
Token: SeLoadDriverPrivilege	560	DrvInst.exe
Token: SeLoadDriverPrivilege	560	DrvInst.exe
Token: SeShutdownPrivilege	924	setup.exe
Token: SeIncreaseQuotaPrivilege	924	setup.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeSecurityPrivilege	1972	msiexec.exe
Token: SeCreateTokenPrivilege	924	setup.exe
Token: SeAssignPrimaryTokenPrivilege	924	setup.exe
Token: SeLockMemoryPrivilege	924	setup.exe
Token: SeIncreaseQuotaPrivilege	924	setup.exe
Token: SeMachineAccountPrivilege	924	setup.exe
Token: SeTcbPrivilege	924	setup.exe
Token: SeSecurityPrivilege	924	setup.exe
Token: SeTakeOwnershipPrivilege	924	setup.exe
Token: SeLoadDriverPrivilege	924	setup.exe
Token: SeSystemProfilePrivilege	924	setup.exe
Token: SeSystemtimePrivilege	924	setup.exe
Token: SeProfSingleProcessPrivilege	924	setup.exe
Token: SeIncBasePriorityPrivilege	924	setup.exe
Token: SeCreatePagefilePrivilege	924	setup.exe
Token: SeCreatePermanentPrivilege	924	setup.exe
Token: SeBackupPrivilege	924	setup.exe
Token: SeRestorePrivilege	924	setup.exe
Token: SeShutdownPrivilege	924	setup.exe
Token: SeDebugPrivilege	924	setup.exe
Token: SeAuditPrivilege	924	setup.exe
Token: SeSystemEnvironmentPrivilege	924	setup.exe
Token: SeChangeNotifyPrivilege	924	setup.exe
Token: SeRemoteShutdownPrivilege	924	setup.exe
Token: SeUndockPrivilege	924	setup.exe
Token: SeSyncAgentPrivilege	924	setup.exe
Token: SeEnableDelegationPrivilege	924	setup.exe
Token: SeManageVolumePrivilege	924	setup.exe
Token: SeImpersonatePrivilege	924	setup.exe
Token: SeCreateGlobalPrivilege	924	setup.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe
Token: SeTakeOwnershipPrivilege	1972	msiexec.exe
Token: SeRestorePrivilege	1972	msiexec.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

Office2010Toolkit.execscript.exemsiexec.exeMsiExec.exeose.exe

description	pid	process	target process
PID 2124 wrote to memory of 2744	2124	Office2010Toolkit.exe	cscript.exe
PID 2124 wrote to memory of 2744	2124	Office2010Toolkit.exe	cscript.exe
PID 2124 wrote to memory of 2744	2124	Office2010Toolkit.exe	cscript.exe
PID 2744 wrote to memory of 924	2744	cscript.exe	setup.exe
PID 2744 wrote to memory of 924	2744	cscript.exe	setup.exe
PID 2744 wrote to memory of 924	2744	cscript.exe	setup.exe
PID 2744 wrote to memory of 924	2744	cscript.exe	setup.exe
PID 2744 wrote to memory of 924	2744	cscript.exe	setup.exe
PID 2744 wrote to memory of 924	2744	cscript.exe	setup.exe
PID 2744 wrote to memory of 924	2744	cscript.exe	setup.exe
PID 1972 wrote to memory of 2164	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2164	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2164	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2164	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2164	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2164	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2164	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1180	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1180	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1180	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1180	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1180	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2644	1972	msiexec.exe	MSOHTMED.EXE
PID 1972 wrote to memory of 2644	1972	msiexec.exe	MSOHTMED.EXE
PID 1972 wrote to memory of 2644	1972	msiexec.exe	MSOHTMED.EXE
PID 1972 wrote to memory of 2584	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2584	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2584	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2584	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2584	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2584	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2584	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2888	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2888	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2888	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2888	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2888	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2888	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2888	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1992	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1992	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1992	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1992	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1992	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1992	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 1992	1972	msiexec.exe	MsiExec.exe
PID 1992 wrote to memory of 812	1992	MsiExec.exe	ose.exe
PID 1992 wrote to memory of 812	1992	MsiExec.exe	ose.exe
PID 1992 wrote to memory of 812	1992	MsiExec.exe	ose.exe
PID 1992 wrote to memory of 812	1992	MsiExec.exe	ose.exe
PID 812 wrote to memory of 1736	812	ose.exe	ose00001.exe
PID 812 wrote to memory of 1736	812	ose.exe	ose00001.exe
PID 812 wrote to memory of 1736	812	ose.exe	ose00001.exe
PID 812 wrote to memory of 1736	812	ose.exe	ose00001.exe
PID 1972 wrote to memory of 2756	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2756	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2756	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2756	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2756	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2756	1972	msiexec.exe	MsiExec.exe
PID 1972 wrote to memory of 2756	1972	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Office2010Toolkit.exe
"C:\Users\Admin\AppData\Local\Temp\Office2010Toolkit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" C:\Users\Admin\AppData\Local\Temp\OfficeUninstaller\UninstallOffice2010.vbs All /Force /NoCancel /OSE /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS /config "C:\Users\Admin\AppData\Local\Temp\OffScrub10\config.xml" /dll OSETUP.DLL
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000538" "00000000000002BC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Indicator Removal: Clear Persistence
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F322D48115A303DCE97632A1D0388996
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2164
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding DC1853DF742E47FCD017B29F59F11CCF M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1180
- C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE
  "C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE" /unregserver
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 33AD24E452B6C16EE96A4200D8541582 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4800994D7792F4BAC76328E7AD58A40E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB7DBB5E8CD31B1B4ED7D0C6519C56B6 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\ose.exe
    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\ose.exe" -standalone:temp
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Users\Admin\AppData\Local\Temp\ose00001.exe
      "C:\Users\Admin\AppData\Local\Temp\ose00001.exe" -standalone
      4⤵
      Executes dropped EXE
      PID:1736
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85F08D85BBD3F72BA70E86E635F5E391
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0B433C05C9FAC5FC0F2FA5B22B275724 M Global\MSI0000
  2⤵
  PID:2152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1C202433DDD912F4C2260E35090916B2
  2⤵
  PID:1324
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A150A031D99C74DE495EA889BA5731C3 M Global\MSI0000
  2⤵
  PID:1804
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7039F38EEBC585AA878FF80C021CC1EE
  2⤵
  PID:2948
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DBB927157DD34B73D381A4A073106AE4 M Global\MSI0000
  2⤵
  PID:2492
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B4CFB6C6FA514950A8C63C4BCEA9A827
  2⤵
  PID:784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7906b9.rbs

Filesize
1.3MB

MD5
c4c2f11fc7101ac8624354959da8a5b9

SHA1
a15533b8cf40b24be9aa92a8cd42b09959e1f0e2

SHA256
f3a118062205867e4a10b707443270f688954c6ac85a9e93c4d4167b8296f087

SHA512
e1b7c3427a1f4b8e2923e327dd562fd5ec8f256c2e78b2d16cdde4d4c30aa9c0ecc8700c0e919e2e3eff739f6507395b2fb541f2da33c0fabb645df30ac01684

Download Submit
C:\Config.Msi\f7906f5.rbs

Filesize
763B

MD5
933bd535730083396ba2e02631bd4eaf

SHA1
7e152b1ac1d8c6b0ca522ffe06f3b60fca4c067f

SHA256
314e932b9723c9d5cd4deecd77756f1dbded825d8a9530ebaab7999ecd3e3cf0

SHA512
22535797a3dd2f664e4635b5dd162cc27623045b678fde801b06272cd5bdcbca4f3b4d433f020edc3f8827c8e8625af49d3111e6d0bb37316e2c9f2f7514a0c7

Download Submit
C:\Config.Msi\f7906f9.rbs

Filesize
729KB

MD5
9dcb79aaec821bf3f27c1abc8da0bdee

SHA1
7588df04578f8f13e56643b3d044dfb5c14c4f83

SHA256
56e7036d6b72fb859a60c4f594dd8e1a6191083e7b46be49babd05fd42272c6c

SHA512
634283681bec536b68aebb140bdd7bf5dce5c663f3b364a5faed276145a64baa05b96e32343f8b522a065ddcb77473e180779b08fefa05a1d4e1e8a1ec8bef94

Download Submit
C:\Config.Msi\f7907ba.rbs

Filesize
491B

MD5
e55877d3c6c8881b7c955956df4d3114

SHA1
573fc984cd9f6da227f941ecd6b4ee8a2bd06f06

SHA256
2dcd2c5c690617868f87fefa887684caa6d2c50616af69ce312ebcc4556d9a29

SHA512
ed86a22ae13d6615414bd031739b475bab1068afd6f328273fa8ef6ea303ec44b9b34ffe04cf14d66435e7a2cd23244d8fe1b8836ddf21274d9f0b54ccc97aac

Download Submit
C:\Config.Msi\f7907be.rbs

Filesize
499KB

MD5
dc64843227c9074e0624b6370ca1bb27

SHA1
a622d5131fc641ab7fd54bc3540625bbaf344a8e

SHA256
2c16278e770a0c3bb01fae82d7811a282362f7ddeeb89bb8b5e7f29adf0b9eec

SHA512
eae7f2eb7a0bfecb3dac70d8a27b3020d8ff46f538c284b2dc5cf904340f3172cf41b77bbaf51b2969a8a787dbb48496d3560adcfef7efb7d9d256832a404e3b

Download Submit
C:\Config.Msi\f790810.rbs

Filesize
485B

MD5
01dfec32af2e2862589de981e2a34dff

SHA1
e660c00c21579066828ae3016c08d83dc87e6ebc

SHA256
2046e504171b66db113fed4a6546cca24bc59f8f55e96bfb5065dc83f3aa4e42

SHA512
23b2f9a9891fbd5583a4876377e0f0dfb6ddd573e3357edb9d75c8c513fe28881066dec29b3a63b1db1694ac740a2619b9e5b7acb93f6c0f7cf3e7d5b8366c14

Download Submit
C:\Config.Msi\f790814.rbs

Filesize
464KB

MD5
de5b61673679768cfa1ecdf39e208b13

SHA1
7c17bfd32616b8ba569647d84d81e9d3cd1a249a

SHA256
701940d622f554102802d1db79b572694c27ea78a0efb271e1ffcdbbeb42c7a0

SHA512
771fa039dfb3ec4598667e5a566474ac1d82dd1a068671510c5458d0a3ee704a14c80bb1995ff22e02fb5cc3266144c42bfc26c71e0c16d9aa6e45325f0ab4a4

Download Submit
C:\Config.Msi\f7908f8.rbs

Filesize
500B

MD5
4180b4f56718cd076bdc234159e91285

SHA1
2f7fdcbcde9e3bd8734abba599cd3e4adeee1fc1

SHA256
b57daa473683fa26168ba31854b316984878ad391df20513afdb2c6097587346

SHA512
e52a8ca180e42082934a2f3c191654add908b72bdffb3bcf3d0a2a82035ac7dde6995e6b72bf7c286a6cb1684e5040f336ff9008fe7399d3e97dbe280ee93b8a

Download Submit
C:\Config.Msi\f7908fc.rbs

Filesize
10KB

MD5
75b88621aff06ee81c9f24dbdb6c252a

SHA1
ae27f3c676c4dbe8620469f0d224511f4ab1d9bf

SHA256
89619c19993e28f7768aac93a946a61691dedcd52eca63a0cf3a16ed6d47c2aa

SHA512
9bca1e08b3738710cbaa08a1277f150fedccbae7b02ed6fe3fcafb21305362271c2a283fbec038c2477a0902ecd9d72bd8435b22b27f451f8b99932cff5a3505

Download Submit
C:\Config.Msi\f7908ff.rbs

Filesize
524B

MD5
420a3cf1d7129e85b2c80adb36510ac8

SHA1
447df0b2c506448a1b3b4bdbad91a8c413c5b1e6

SHA256
e726ecb6f86ac110231a49af05b766b5f3ee38a176d872da2ec04e67c909c3dd

SHA512
6d04ed3f62fa797e58bb5a52dcc2ca381bd03274a25398790c2adceee7d7975cd393723bcbc6a7f1c6b9d2caa0bd50aedc0bf7e891de64b45d84422c9752e020

Download Submit
C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

Filesize
252B

MD5
b8d7a4a0196bd1b6fa07e4adcffb96d3

SHA1
052fb3c7a45e5abc392b690a9081a362a1bc65cd

SHA256
4c38376a218c3a0261489ca35ba9904d92e1c642e2b811fdd1a233b59e4edcba

SHA512
e0fd7f03e0cbbff4e05eefdec6e189ccf9122099eb5dadb66e845e51d6bfed49ab7a44bb03925fc52fb303068fab8737ac85e3212adff93cd7fcee4c6596c8df

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl

Filesize
6KB

MD5
df362f0caf1c711e9fee975717958d76

SHA1
f352a0bee613e82688cae3996554a821bf0045f2

SHA256
9e2d8b39b758ab1f5724e0c8238d61b848b49d7af13f127971200c5e2680efc5

SHA512
8e3e795f1e79a52ca7605a787b8b258a669047f595f6fb257e4d6a36f7e563ceb330bfcefb87a752b9cf86ed5792b21ef2803a65905fbd86d1042394526172ee

Download Submit
C:\ProgramData\Microsoft Help\nslist.hxl

Filesize
5KB

MD5
9675ee7eb2345dce95b8e031cb8d8835

SHA1
9956bc9b2c88c0cf41bc03d1645b3a8f0c628ba1

SHA256
04819f36eead81c52397ad27128b6b2ee9f19c82037288da0aed2ee5fc068ca3

SHA512
7fcab43ed92ba0177bb23d5392b9d0f61f71c1c22dd4a6b932ed5bde7d4296d336885d61b1aa99be885ee20f2b3b3831e32687dfd4d03266c360ea2c6db83f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hx9EAF.tmp

Filesize
856KB

MD5
23fdb0c309e188a5e3c767f8fc557d83

SHA1
1c5d6cccfd6cb13fe428f38c755047688c1bd56d

SHA256
1a0f889ca5ffa151ccd8d4c210682c33c567e20db50e9091e664d9493d2b3980

SHA512
794317a39add52bfb99db6f8c25b1fb734b1f20a9bbcb173934150cb65e5f0da37023ff86342bb4d3a0d1a9e714ff3aa682b5fecc1cef87285c96f40e52c9e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\config.xml

Filesize
656B

MD5
c04535ab0443340ccdd2ff4cad79fda0

SHA1
9735a62aaed3823174a5904ddec2fe5c1190c0cc

SHA256
eb4b99ac3c6fd2ccd154184e24cacd1f0f03b5b50e9dd4f1d7299c41e75054a9

SHA512
ed5d54ce46d4ea75f2c1bbfe9b20082f2550af1533b4577d6d23e745801ecbdc1090c3ef734f8ce3326422f3c9558201947efba7491728e495d4e914e0baa293

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-0011-0000-0000-0000000FF1CE}.msi

Filesize
23.7MB

MD5
f7dccd578605f72aeeed775c9eb40ab8

SHA1
b8ffb0dd78c4d0d42f277532e9d5e776ea95f905

SHA256
94394a95064eb630cddb99a16607f3d3bab7cff8741ac9ced2ef57b819bf08e6

SHA512
4f376be1f12fd3f426ba911e7d9774726f66bb1fb55cca22e76fd1fda4def06ceb05b5a52809fd40e475cb9421e82ef2e6aebf930103b4f0d522cac075b221c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-0015-0409-0000-0000000FF1CE}.msi

Filesize
1.7MB

MD5
cf9c4d8334e87dd2c48e5e0b67f60ea3

SHA1
da577a64e88648a7fb6b7f63a938fd7b803514c8

SHA256
db5b098a95be7cb6832fe785cc3585ee35e60bb231518253084cf7d473aa1fe2

SHA512
18d253817d8bc09c5405b964c5c8e187437c153aff07ae448500f6ec5059a83e01ae561c73a06d09ddcfacfa20f040aa24c1bd585918688062880a2f89fde7d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-0016-0409-0000-0000000FF1CE}.msi

Filesize
1.7MB

MD5
21a54f52d36f9b385d0bb2c8aa1b425d

SHA1
7fb5d245812304ea917cdb9067de927d8d40108c

SHA256
d20dd69495471d71f4ba8700f4572fe5e2974260bbb93d52e8bfed9c072f1e07

SHA512
5ffbe026971b6c54aa6dd85fdfe1622d037d580645f14ba2aa53c84211e2ebdc3dbe478305f124048dfe1b10beefa6daefb3cde45c8f7012b59e6a84517eec04

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-0018-0409-0000-0000000FF1CE}.msi

Filesize
1.7MB

MD5
d10154e516838bb86fd8491dfbdd1f59

SHA1
0371f0e766eadc9377b251a5ccc8fdabc9cf97b4

SHA256
ace07aa366fb84193a02baadc3529f9384b48aa453f71ab9be4e5ae41a7330c0

SHA512
b34254c1065e0400de27dcd68cbc52e51984539d103bf03920a421a7527cfb662902e168f360453a8ef4841f0655f54e08ffc057d8fa3a999d4eef9713dbbad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-0019-0409-0000-0000000FF1CE}.msi

Filesize
1.7MB

MD5
bcdd7636c300ce4b2639c0d19cf96f59

SHA1
f71888bbf428182cfcfcd0ffa183c9873c298384

SHA256
a57fc9a42b7ca375f0e57131b297eed920f33c7111e83f7ab7b457ab089c7d76

SHA512
0fd3d38eb5c1dfc7f3fa8f088da57ec1fbd203f17b8e3fb18c5f5de480163f71b36521f9c89e62feedff2e07c880d55fb24cefd3b343bd964611abf8116c06bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-001A-0409-0000-0000000FF1CE}.msi

Filesize
2.0MB

MD5
bf4b5a360f8c2d4f693305e06ad3e328

SHA1
04207a2547a12911a04f5e8a185f7f76e738dbc5

SHA256
cf03e5d8433522680ac8acdd590ba95172a9b2534fd895c82d442b1d49e32483

SHA512
966b37b6ad9116ee1693ed35c2cdbdcc88af426d281bb8f99240ffb1bdaac6e12faff53e124fc8a8dcf82dcd5cbc76dc5e78a2e8fe1f06e30bcb41c96f7ba0e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-001B-0409-0000-0000000FF1CE}.msi

Filesize
1.7MB

MD5
5921378b2bee035beb7fb146ca5dc89e

SHA1
c07bb1d44ea3d7defd7ef3bf33421057c5027984

SHA256
c3baba607d65c600f0bcfc4eeb9929cacfc02584ab25be8e2d4f8f8e7e463976

SHA512
0755a27ed8523fccd1dd455af56f17d73bb655221fe87bef51ebe22c9186b208e19065a12617785191601d035a86f6380b7e0e401bb3470a540c8856b51d0806

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-001F-0409-0000-0000000FF1CE}.msi

Filesize
641KB

MD5
8dbcfb3ba5b273cbda729175ee28c7e2

SHA1
ed72920f91906aaa8dca1b3fa679fec53e415a1d

SHA256
ee33384f148cba09c3f3cf3f98551134ebdf6dc79854400d7ffbdb578a6c3845

SHA512
0458cc4b8e4c478e3c876d6bbe8900ac445ac3407c65e73a61757379716d82806e35d6012bb4770e6dde5cace38db8e65dc73371e9d77c005ab7dbafde090671

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-001F-040C-0000-0000000FF1CE}.msi

Filesize
652KB

MD5
ecfb202fd60d293dfadfa1fc24935c55

SHA1
dea55058715543fad1ce1a5f8e9127ca89bf88a3

SHA256
fb6e1d539e131b2f59e10db9dd7c593c82d7b552505ff1733b0b8491f8a6957a

SHA512
76d517a7ae54614a7f05245b40ebffdd06f7dce15de4558dcc760785b4c96adc75bc2dfe5e37c1fe71c7e3a563d97ff79f83b09f01df528edc654ee2420ee31d

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-001F-0C0A-0000-0000000FF1CE}.msi

Filesize
647KB

MD5
9ea20b6803f30cbb34f6d3aeaae1845f

SHA1
bd3c3bef76f04165a507e584f1589efc2212c04c

SHA256
fad47b8cd96a41f574be4014e1a8b63f90689422e7babce215ad8ca70b023968

SHA512
d867857a00cbe388a74166d3b784f6b9c6748534e186fcf632f8f7501f42f1e2321fee66ca18ad75c69bb9d4c7aeabe66d06b71159fa36a7202b5cda35fa737c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-002A-0000-1000-0000000FF1CE}.msi

Filesize
2.9MB

MD5
43b44c38be513d9589ecac7129ddc7c3

SHA1
f4e519f30fdcf71b56d91d52436f99188238e89d

SHA256
32564d84ef0a140f49ad54eb49de6a3389bdc903be694139b371d95abcc6f6bd

SHA512
cb357a6dc3393b4833115c110e8eee5795fd1aa90eb9c82c6a9798cb0f05d6052ac8611e289d83cf668135b8276973c1de221d6157fc742ef3645bf485dac4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-002A-0409-1000-0000000FF1CE}.msi

Filesize
638KB

MD5
1f926afe0b6c5f4ff1fe2ab0c5406fc9

SHA1
7a2c2a2f2092374b44fb54e4edead032f3d98129

SHA256
6466dc11dabb8f2c6359ff9ffad2625cd7c18ef84c55c450e3e02991fe084a10

SHA512
a57f59a49663d5d1ce12de0d7267282274cbe9e32349b808648abec899379c23a04e690d45e8e25762d04c6cf26ac61e20ae99f6a30d538342780f8f2dd11ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-0044-0409-0000-0000000FF1CE}.msi

Filesize
2.3MB

MD5
5aee9f312d877d4eeb88eac7a6e3c0dd

SHA1
fbf9762b867740bfbcadcd23f631697183059bb2

SHA256
ac757a1183d11b7be06efcaef82f842ebd78e64c838d580e1c93da483de62f62

SHA512
caeabce46812f7566ff07f3c77c54d6816d0fbb8210b08f8ff327ad5f8362fbc73355a31d27f95c5bba82abb1d560ea13d8340e62846d1893015013939e86e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-006E-0409-0000-0000000FF1CE}.msi

Filesize
2.7MB

MD5
a08d64fcd01b89e0326fea7981a58480

SHA1
4828aaa85f7601ade9777e6dcd30b32124d19071

SHA256
185bc16acc691390159e4b5008f85fe6eb390cbfb485dcf2fc7839995c3f3af0

SHA512
c4024a549302f09c1492bb819fdab4d57a0d1c50afcd6c468530451031d8bc2ef0ebd3e81a0b68e9d2c052364b8d511697493adde7f2bcecb82a9fd676b5cbe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-00A1-0409-0000-0000000FF1CE}.msi

Filesize
1.7MB

MD5
ff47b42c9fe0f1504164f0c2061d0774

SHA1
f6eb70ab8a501b5af5ea39cdbca1b709ac45638c

SHA256
d01dbff0bfc26d4189478e176b218200271e838bbf4484b49bed25b04238d247

SHA512
55d5f4839e9056f80b12a3727578739ef2d9c7c7392d512bd2936b6640638c567c6374e011041fceb9f98862c52e2a5c6b8136b7b552822d25abe18382e7bf1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OffScrub10\{90140000-00BA-0409-0000-0000000FF1CE}.msi

Filesize
1.7MB

MD5
d5361e0cbc3b524d5d423eaaeb20a548

SHA1
5cd1bfa5abe90e9cf88bfb57fb7071f6eb7a6963

SHA256
4ce70f02c7bd502adcf13b3efe91de6dab3061444bdfabae8abac251958961ba

SHA512
a501a36a67d233ab763b86915e21cd05fc2994cc3839ecee11bc56d3d0e55f35fd06c0771a6345f9ecb11605a3ad06364660c19d41b4e0d3442dc493bc3dfd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\OfficeUninstaller\UninstallOffice2010.vbs

Filesize
137KB

MD5
3dc193c2b5e62a2350d12a94edb306d2

SHA1
bff79bad4af341161573ed323b07b389e4ce40ad

SHA256
bfc2b4c459b48ae35f2167667756eb5a70593e0e295cb8a9520e7ba39d4e43d0

SHA512
722360fdfbaf9e403dd7ac9079030186bc437aa8783a249af88d58f4bad266620511a64319280b72615ce5852929a337bb22ae418a4149daf319a39b4774b1a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Settings.ini

Filesize
688B

MD5
eebbf786036ef7e636aeee51822e8beb

SHA1
8b2efc8f26c7ee697b782ca34cd7652678235073

SHA256
9f17ed87e1b647b8ea084c9d2d1679ee4b2ee4294cc49af255f57ed86d4b1d8d

SHA512
b21f2bae3f8948efc7914af458f7c4cd0da047a54394ccc4883ba3fdee552b0eda850e578070c84d938184cac48d9f6f30c2098b6f94e8ecf8bce0131c1de8fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ose00001.exe

Filesize
145KB

MD5
9d10f99a6712e28f8acd5641e3a7ea6b

SHA1
835e982347db919a681ba12f3891f62152e50f0d

SHA256
70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc

SHA512
2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5

Download Submit
C:\Windows\Installer\MSI15C8.tmp

Filesize
148KB

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSI46F8.tmp

Filesize
556KB

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
C:\Windows\Installer\MSI722.tmp

Filesize
257KB

MD5
d1f5ce6b23351677e54a245f46a9f8d2

SHA1
0d5c6749401248284767f16df92b726e727718ca

SHA256
57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

SHA512
960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

Download Submit
C:\Windows\Installer\MSI8A9.tmp

Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSI8DE8.tmp

Filesize
64KB

MD5
2af7ac092d41bae372787c21a4c81242

SHA1
29f4a6fcc0545682aecda7ed27c0c9580851c3d1

SHA256
174278900dbad135e87318e07c8fbf16b819320bb68ac5d8e9e97f745f9360a6

SHA512
f1390fcd9e08eb30b407e160395a6c6b890a2ce8afafe5c25109af6dd220994efe1b3dc1317db9ec109340e822569661665bbe345f51e7bfba65abaebcaea793

Download Submit
C:\Windows\Installer\MSI9135.tmp

Filesize
303KB

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI961D.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI9E6B.tmp

Filesize
107KB

MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
C:\Windows\Installer\MSIADDB.tmp

Filesize
134KB

MD5
b8255a1bc3c307557741d2c99b8256d1

SHA1
48cc6f3c1a566f06684c5184cf830cbd7db638c2

SHA256
796aea9a46fb7704222a7fe1f4e27455b14640c816d6f961344f89dc47537b33

SHA512
85f685ad84f2208ad87ff34fb5e99edae50fc938a9335cb9747b7707d237c1b397c318090112eee0e9f04777ee004e26e7377f57c3e31159a96638b65110a69c

Download Submit
C:\Windows\Installer\MSID7A.tmp

Filesize
84KB

MD5
3e8bac0631b8cf3d44582796943089a9

SHA1
e028b364f8771b2296424e71e3b90c9b59492636

SHA256
dbc981319e2fd24452a71ce7622244284b332e882a20df7c1ca32447d7cf1c0c

SHA512
3924379adfbefafff91768523dd59861a53738cd7a8ddc5a5fbc1b7f7dd8dbe963f5effdcdffa788346292ec33c55bcf44ff779cfe44ca9c757aeb543e4ab6cd

Download Submit
\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL

Filesize
145KB

MD5
8c362bc4687838891922dbd00d622acd

SHA1
baa7b4fba6519d3f3d3da305e7fcab31f1ec8051

SHA256
383ff92cf608b77a1e5e24d65f2089d8b22c1594b58f0f86994322586fe5cede

SHA512
3504c0097400fc05591e275e64aeba899a2a9def68e2313b6b73d9185bf8683d991bdafc79c1d9e74ac897d11c907c254d44817e100ac9e17c3ab55d0d5e90f4

Download Submit
\Program Files\Microsoft Office\Office14\MSOHTMED.EXE

Filesize
85KB

MD5
78e89dc545e6374c4e6c09c1d3ce0466

SHA1
bcbfe02e7fed041894db6404e60690d02301b763

SHA256
fabc7c12fd6523338f8adb3fefcaed7f213afe95e784ef36ecdf42da67421ab1

SHA512
6f4dbd49e79c5e540ea9b35e4acbcaf7c294781691ee4681580048aa75671d9d3f48c4d474ec834d9c193d2c597302554a6ce6c10651a4cc9d11db284b0884f8

Download Submit
\Users\Admin\AppData\Local\Temp\Setup0000039c\OSETUP.DLL

Filesize
5.5MB

MD5
fcc38158c5d62a39e1ba79a29d532240

SHA1
eca2d1e91c634bc8a4381239eb05f30803636c24

SHA256
e51a5292a06674cdbbcea240084b65186aa1dd2bc3316f61ff433d9d9f542a74

SHA512
0d224474a9358863e4bb8dacc48b219376d9cc89cea13f8d0c6f7b093dd420ceb185eb4d649e5bd5246758419d0531922b4f351df8ad580b3baa0fab88d89ec7

Download Submit
\Users\Admin\AppData\Local\Temp\Setup0000039c\OSETUPUI.DLL

Filesize
187KB

MD5
196a884e700b7eb09b2cd0a48eccbc3a

SHA1
a400c341adaf960022fe4f97ab477e0ab1e02a96

SHA256
12babd301ab2f5a0cd35226d4939e1e200d5fcf90694a25690df7ad0ea28b55a

SHA512
b9f0229e3ed822b79ab2ffa41b67343215bde419a44c638422734f75191f2359bcfeb3553189e17a89b5edfa25016484ec78df48eb05049c72b1d393dd3f4041

Download Submit
\Windows\Installer\MSI8F51.tmp

Filesize
68KB

MD5
954c7720c5e88fa690fd1d38dec47347

SHA1
2f5b87593066dac3f5a58272358b1e8e27a9dfe8

SHA256
532343ebbf4572f69673a0adc5d5737fee88aa73c1acb3b15554338c3033cc0f

SHA512
0425dc825eb9389309e73bd545a5904ff9aca9b29605ac70294859bf38abc0f1366fd119d84458f766b81cf7c9fc212d64a2c8faa1d3a84993902d6196f5d51f

Download Submit
memory/2124-0-0x000007FEF672E000-0x000007FEF672F000-memory.dmp

Filesize
4KB

Download
memory/2124-34-0x000007FEF6470000-0x000007FEF6E0D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-32-0x000007FEF6470000-0x000007FEF6E0D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-31-0x000007FEF6470000-0x000007FEF6E0D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-2-0x000007FEF6470000-0x000007FEF6E0D000-memory.dmp

Filesize
9.6MB

Download
memory/2124-1-0x000007FEF6470000-0x000007FEF6E0D000-memory.dmp

Filesize
9.6MB

Download