949617f5b2e6b70ec811407e3fbcf2987c456f8452dc6be742292171d875ed29

Resubmissions

16/03/2023, 21:59

230316-1wbcksda55 8

16/03/2023, 21:26

230316-1apm3sch62 10

Analysis

max time kernel
1793s
max time network
1591s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
16/03/2023, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BALLER.png
Size

136KB
MD5

e5476eec7ccd2de2782fc882ac6e9543
SHA1

e43f6a54de4a410531b7862c99d4a5ce769206be
SHA256

949617f5b2e6b70ec811407e3fbcf2987c456f8452dc6be742292171d875ed29
SHA512

d017c360e0268b5efc835316770e7f0077c64134a6dc5c5c0e9fc11f2ef9f31db28545813937d2a16be13a862d0eab026a26f23c6ee6dd2204b00b485a7fa235
SSDEEP

3072:m6XKQzS9Lq16WoWs6WNxE1kT6Z8sgn2my4WKNb:z8slIND6sdy43Nb

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{8A69D345-D564-463C-AFF1-A69D9E530F96}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Sets file execution options in registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	integrator.exe

Executes dropped EXE 7 IoCs

pid	Process
1884	schtasks.exe
6440	Uninst.exe
6784	ose.exe
6812	ose00000.exe
6764	Un_A.exe
60	MSID812.tmp
2212	FullTrustNotifier.exe

Loads dropped DLL 55 IoCs

pid	Process
5736	MsiExec.exe
2416	MsiExec.exe
5736	MsiExec.exe
2416	MsiExec.exe
5736	MsiExec.exe
5736	MsiExec.exe
2416	MsiExec.exe
2416	MsiExec.exe
2416	MsiExec.exe
7272	MsiExec.exe
6764	Un_A.exe
6764	Un_A.exe
6764	Un_A.exe
7460	MsiExec.exe
7460	MsiExec.exe
4916	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
6696	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe
6696	MsiExec.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0042-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0015-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155}\InprocServer32	integrator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\InprocServer32\ = "C:\\Program Files\\Java\\jre1.8.0_66\\bin\\wsdetect.dll"	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0096-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{DBC80044-A445-435B-BC74-9C25C1C588A9}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0101-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0070-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0030-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0024-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A37BBB42-E8C1-4E09-B9CA-F009CE620C08}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0093-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0082-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0007-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0061-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0033-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0101-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0036-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0042-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0040-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D0B22D03-D05D-4C6D-8AB7-9392E84A87B9}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{59191DA1-EA47-11CE-A51F-00AA0061507F}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0014-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0099-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0027-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0046-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB968F1E-E20B-403A-9EB8-72EB0EB6797E}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0101-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0033-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0052-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0087-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0017-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0058-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0003-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0032-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0075-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0091-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall 18.151.0729.0013 = "C:\\Windows\\system32\\cmd.exe /q /c rmdir /s /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\""	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows\CurrentVersion\Run	setup.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	OneDriveSetup.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	integrator.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log	addinutil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	integrator.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db	integrator.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\LICENSE	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\	Un_A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\trusted.libraries	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\selector.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js	Un_A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\selector.js	MsiExec.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\fontconfig.properties.src	msiexec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\	Un_A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbytools.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\x_2x.png	MsiExec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css	Un_A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\msvcr120.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_removeme-default_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\awt.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_anonymoususer_24.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac	Un_A.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\	Un_A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MinionPro-BoldIt.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\editpdf-tool-view.js	MsiExec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\README.TXT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reminders_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\redact_poster.jpg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\es-419_get.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css	MsiExec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll	Un_A.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\en_GB.aff	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	MsiExec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	Conhost.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\dummy.aff	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\HW7A3XRH5O\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	Conhost.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	uninstall.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\cryptocme.sig	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSID24A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SC_Reader.ico	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	Conhost.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSIDF7B.tmp	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\ATZYELXOPQ\MSCOMCTL.DLL	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB63.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\assembly\pubpol40.dat	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	Conhost.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\temp\VMG63L2UH8\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	SearchUI.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\assembly\pubpol36.dat	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\comments.aapp	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\17BDP8V1NS\stdole.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2A8.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File opened for modification	C:\Windows\assembly\temp\0U3UN8G7A0\Policy.12.0.Microsoft.Vbe.Interop.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID697.tmp	msiexec.exe
File created	C:\Windows\assembly\pubpol25.dat	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\IA32.api	msiexec.exe
File opened for modification	C:\Windows\assembly\temp\WW48W05738\Microsoft.Office.Interop.PowerPoint.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eBook.api	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\vcruntime140.dll_x86	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol37.dat	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\temp\QWF28002GJ\Microsoft.Office.Tools.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\appcenter_r.aapp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\assembly\temp\BX7UY80I8G\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll	msiexec.exe
File opened for modification	C:\Windows\assembly\pubpol39.dat	msiexec.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe

Checks processor information in registry 2 TTPs 37 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	integrator.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 19 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	integrator.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	integrator.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	integrator.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0"	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{44D1B085-E495-4B5F-9EE6-34795C46E7E7}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|5"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|11"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	integrator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.4 = 2e5368617265642e4967782e456e7375726545326f4d6f6e696b65724166746572456e7375726545326f222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4e6577456e737572655549444c6f676963222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e4f6666696365496e7369646572526567697374726174696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e416c6c6f7746696e6450656f706c655573616765496e41744d656e74696f6e222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e4175746f436f6d706c6574652e46696e6450656f706c65537570706f7274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5043582e4669784e6f6e526566436f756e7465644d736f506572736f6e6173222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e4261636b67726f756e64576f726b436f6e74726f6c6c6572427567466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e427567466978466f7250686f746f41637469766974794c6f6767696e6752656d6f76616c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e436f6e746163744361726456324f766572666c6f774d656e7573506861736532222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e46696e6450656f706c655573616765456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e497350656f706c655365617263684578656375746f72456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e506378417072696c323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784665627275617279323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784a616e75617279323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784a756e65323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e5063784d61726368323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063782e557365506378436f6e74616374496e666f4c697374222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378417072696c323031374275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6d6d6f6e436f6d70617265427567466978222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6e746163744361726444706941776172656e6573734275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e506378436f6e7461637443617264466f6e74486569676874444450494275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784a756e65323031374275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784d61726368323031384275674669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5063784f63746f626572323031364275676669786573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e436f6e7461637453656172636849676e6f72657353796d626f6c73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e50637848616e646c65734175746f446973636f766572222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50656f706c655365617263682e526563697069656e744175746f436f6d706c657465537570706f7274222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e50726f6f66696e672e4175746f4d616e616765722e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e536d6172744c696e6b732e416c6c6f775265636f676e697a65536d6172744c696e6b73496e7369646550617261677261706873222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e54686573617572757350616e652e41637469766974696573222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5472616e736c61746f722e456e61626c65466c6f6f6467617465537572766579222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e5472616e736c61746f722e466c6f6f646761746553757276657944656c6179222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e46574153686f756c64426c6f636b53656c4368616e67656446616c73654576656e7473222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e53656e6445646974466c6167546f4e6f4572726f724576656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e576f72642e57726974696e67417373697374616e63654372697469717565466f724347415049222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5368617265642e57726974696e67417373697374616e636555492e50616e652e46697857726f6e67436c6f73654c6f676963222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e436f6c6f72466f6e74537570706f7274456e61626c6564222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e46696c6556657273696f6e696e67222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e48696464656e466f6e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e4f4172745465787456616c696461746552616e6765564544222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e416c6c6f774475706c696361746555696d557064617465222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e536861726564546578742e52696368456469742e436f7079506173746548544d4c222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e417269614d617854656172646f776e55706c6f616454696d65496e536563222c20225622203a2022696e7433325f747c3222207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d657472792e566f6c756d65547261636b696e674d61784576656e7473222c20225622203a2022696e7433325f747c3530303022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4169725370616365222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224261636b656e645c22203a207b205c224576656e74735c22203a207b205c224c61796572486f7374496e697469616c697a6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706f7369746f7253657373696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c2257696e33325c22203a207b205c225375624e616d657370616365735c22203a207b205c224c65676163795c22203a207b205c224576656e74735c22203a207b205c22416e696d6174696f6e50657263656e74556e64657233304650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416e696d6174696f6e4176674650535c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726f737357696e54496d654f6646697273744672616d655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224176657261676550726573656e74735065725365636f6e645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e4368617274696e67222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22436861727445326f536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224368617274696e67456e644c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436861727445326f4c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e436c69636b546f52756e222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74735c22203a207b205c225461736b4c61737452756e4865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e6976657273616c426f6f7473747261707065725c22203a207b205c224576656e74735c22203a207b205c224170706c69636174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6c6c656374456d6265646465645369676e61747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616c63756c617465506172616d65746572735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225363656e6172696f5c22203a207b205c224576656e74735c22203a207b205c225570646174655461736b557064617465646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b557064617465636c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b46756c6c7265706169725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265706169725461736b52656d6f7665696e7374616c6c6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b436f6e6669677572656c696768745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c69656e747570646174655461736b436c69656e74646f776e6c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b53747265616d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e7374616c6c5461736b437265617465776f726b696e67636f6e66696775726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174655461736b55706461746566696e616c697a655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436c69656e744361624d616e616765725c22203a207b205c224576656e74735c22203a207b205c225461736b557064617465436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b436c69656e74446f776e6c6f6164446f457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253747265616d4361625c22203a207b205c224576656e74735c22203a207b205c22446f776e6c6f616453747265616d4361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225472616e73706f72745c22203a207b205c225375624e616d657370616365735c22203a207b205c224578706572696d656e74616c5472616e73706f72745c22203a207b205c224576656e74735c22203a207b205c22436162735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c224576656e74466c61675c22203a20323536207d207d207d2c205c225472616e73616374696f6e616c46696c654f7065726174696f6e735c22203a207b205c224576656e74735c22203a207b205c224170706c794368616e6765735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22457865637574655472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c225472616e73706f72745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f776e6c6f61644361625c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446961676e6f7374696373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c6563746f725c22203a207b205c224576656e74735c22203a207b205c2253746172745472616365436f6c6c6563746f725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446f6373222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22536861726564436f6d6d656e74735f447261667443617264556e6d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22536861726564436f6d6d656e74735c22203a207b205c224576656e74735c22203a207b205c22436f6d6d6974436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744e61746976655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22447261667453746174654d616e61676572456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f737444726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465506f7374416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245324550657266547261636b65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224472616674436172644d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244726166744361726452656e64657265645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d61726b436f6d6d656e744372656174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656f70656e546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265736f6c76	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\EUDC	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	integrator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.12 = 2032207d2c205c22546172676574546578744c616e674368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22546578745472616e736c617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e496e7365727465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e4c616e6775616765734c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736c6174696f6e5461624368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e4578616d706c655265747269657665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416c7465726e6174655472616e736c6174696f6e436f706965645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464496e4c6f616465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e5558222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c225344585c22203a207b205c225375624e616d657370616365735c22203a207b205c224d65436f6e74726f6c5c22203a207b205c224576656e74735c22203a207b205c22547261636b65645363656e6172696f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225465616368696e6743616c6c6f75745c22203a207b205c224576656e74735c22203a207b205c225465616368696e6743616c6c6f7574416c726561647953686f776e4d617854696d65735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574416c726561647953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465616368696e6743616c6c6f7574546f6f4d616e7953686f776e5468697353657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2244796e616d69634470695c22203a207b205c224576656e74735c22203a207b205c22446973706c6179546f706f6c6f6779456e756d65726174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446973706c6179546f706f6c6f67794368616e6765645c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22446f63756d656e745265636f766572795c22203a207b205c224576656e74735c22203a207b205c22496e76616c696461746550616e65735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22546f6f6c746970735c22203a207b205c224576656e74735c22203a207b205c2253686f77546f6f6c7469705c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22416e63686f7252656769737472795c22203a207b205c224576656e74735c22203a207b205c224765744f72437265617465416e63686f7252656769737472795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22526962626f6e546162735c22203a207b205c224576656e74735c22203a207b205c22526962626f6e5461624163746976617465645f466c6f6f64676174655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d2c205c224576656e74735c22203a207b205c22436f6d696e67536f6f6e54435348574e445c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f46696c65457874656e73696f6e49636f6e4d617070696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e576f7264222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224c696e6b6564496e5c22203a207b205c224576656e74735c22203a207b205c224372656174654c696e6b6564496e526573756d65417373697374616e745461736b50616e655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c2246696c65536176655c22203a207b205c224576656e74735c22203a207b205c225361766541735361766546696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22416374436d64476f7375625361766541735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f435349464f4353536176655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436d645361766546696c65436f7265325c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2246696c654f70656e5c22203a207b205c224576656e74735c22203a207b205c22446f634e6f7469667943616c6c6261636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f4e6f746966794d657267654469616c6f675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22464e4d45696453657446726f6d5873747a46747970466e6d4469725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e697469616c697a6542696e6172794261636b696e6753746f72654361636865735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22436f417574686f72696e675c22203a207b205c224576656e74735c22203a207b205c2253686f77526573747269637465644d6163726f45646974696e674275734261725c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246586c7255736572507265666572656e63655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f63735472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436f617574684d657267655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225365745464725265616479466f725472616e736974696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f6373446f776e6c6f6164526566557064617465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244796e616d696353617665496e697469616c496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22507573684f70436f6d706c657465645374617475735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22466f726d735c22203a207b205c224576656e74735c22203a207b205c224c6561726e696e67546f6f6c73576b4f6e446f63756d656e744f70656e5c22203a207b205c224576656e74466c61675c22203a203439343038207d207d207d2c205c22446961676e6f737469635c22203a207b205c224576656e74735c22203a207b205c22566563416c6c6f634661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224f4353425c22203a207b205c224576656e74735c22203a207b205c2256636c6f6b4f6e446f63446973706c61795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e53617665436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2256636c6f6b4f6e55706c6f6164436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c22536176655c22203a207b205c224576656e74735c22203a207b205c22436f61757468436f6e74656e744c6174656e6379496e536176655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436d64446f53617665446f63436f7265436f6d6d616e64416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436d64446f53617665446f63436f7265416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464d617953746172745472616e73616374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224669726553746174654f664175746f536176654f6e436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456964456e737572654f70656e466f72536176655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2242475361766546616c6c6261636b546f46475c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224544505c22203a207b205c224576656e74735c22203a207b205c22446f63756d656e744964656e746974794368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f6f66696e675c22203a207b205c224576656e74735c22203a207b205c2250726f6f66696e674e6f50726f6f66526567696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225453706c4c6f61644c6962726172795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c6f75645370656c6c6572436865636b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6f50726f6f6652756e4469666665727346726f6d5061726150726f705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c617373696669636174696f6e4372697469717565526573706f6e7365506572664d61704578636565645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224772616d6d6172436865636b657243616c6c5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72645c22203a207b205c225375624e616d657370616365735c22203a207b205c22426f6f745c22203a207b205c225375624e616d657370616365735c22203a207b205c2254696d696e675c22203a207b205c224576656e74735c22203a207b205c22446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d207d207d2c205c22426f6f745c22203a207b205c224576656e74735c22203a207b205c22416464696e4d6f6e69746f7256616c6964617465426f6f745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e44697361626c65644469616c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416464696e4d6f6e69746f7256616c6964617465426f6f74325c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22576f72644d61696c5c22203a207b205c224576656e74735c22203a207b205c2248724c6f61645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224872536176655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f6354696c696e675c22203a207b205c224576656e74735c22203a207b205c2254696c696e6749646c6542756e646c654576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654865617274626561745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2254696c696e6749646c654669726542756e646c65644576656e74735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577476574456e756d657261746f724576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e7456696577446973636f6e6e6563745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b52656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225465787454696c65446f63756d656e745669657753696e6b556e72656769737465725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2254687265655761794d657267655c22203a207b205c224576656e74735c22203a207b205c22435254435265766572745265706c61794b706f7353636f70654475726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2255494d5c22203a207b205c224576656e74735c22203a207b205c224655494d426567696e556e646f4265666f726546426567696e556e646f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224655494d426567696e556e646f416674657246426567696e556e646f5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224163636573736962696c6974795c22203a207b205c224576656e74735c22203a207b205c22416363436865636b657256696f6c6174696f6e547970655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e526573656172636865722e4e6f64654a5357656250616765457874726163746f72222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e48656c704974656d53706c6974427574746f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e48656c7050726f7669646572456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e497350656f706c654974656d53706c6974427574746f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e4d616a6f724974656d53706c6974427574746f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e4d6178436f6d6d616e64526573756c7473546f52657475726e222c20225622203a2022696e7433325f747c3422207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e506172616d657465725465726d50726564696374696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e51756572794c6f6767696e67456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e536861726564446f63756d656e74456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53686f756c6453686f7748656c70416374696f6e73222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e53686f774f6e6c794974656d4c6162656c49664465736372697074696f6e49734e756c6c222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e57617465726d61726b506172616d65746572697a6174696f6e456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5543492e54656c6c4d652e5a65726f417373697374616e6365526573756c7473456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e4973506572736f6e6150726f66696c65504358456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e52656d6f76654d53414148616e646c6572466f7254657874426f78222c20225622203a2022626f6f6c7c3022207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5465616368696e6743616c6c6f757454696d654f6e53637265656e54656c656d65747279222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5468656d696e672e5573654d656469756d4c756d696e616e63655468726573686f6c64222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f72427573426172456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e5558506c6174666f726d2e5569614e6f74696669636174696f6e73466f725465616368696e6743616c6c6f7574456e61626c6564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e566973696f2e484f50657266496d70726f76656d656e7473222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e57686174734e65772e454353446174614c6f61646564222c20225622203a2022626f6f6c7c3122207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304b42416374696f6e222c20225622203a2022696e7433325f747c3322207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e576f72642e4275666665724f6f6d3130304d42416374696f6e222c20225622203a2022696e7433325f747c3322207d	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|0"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|6"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t\|1679049241"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\DevModes2	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1"	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|10"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|0"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile\MsaDevice = "t=GwAWAbuEBAAUKFVEGReoCdHdlh1TorgVuqX+P2gOZgAAEM+JcFz+gmqJ1d+rpgNt9DjgAG3mUyxCk8VM10qELONgGoR0GLP90pIPGbPDOWs/T+VBXqJuxvVtRvg0GY0petJS983l35iKqF4Yz/6kZD8HAt8icFU1tSNPc+DHSxlsOhIFQNUMIteDS455DQbUq/xG+Uob+HKrPouXn21BPicFl6yiXoB72DHTL8/yQ4E1qqU6swfLu2UWQMmzReJn4zhRB9aESwHuAEidsorbk7hblmfztHJjUcq/g6FZEYUu7Ikq3SsLIMydPE1ok8K8ymXhaVP3A2yMiCUclVxQjASvqPgDh030dzfiybEtbHnvrIKQHQE=&p="	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\ClickToRun\C2RClient\C2RClientReturnCode\7684_ExitCode = "17004"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigIds = "std::wstring\|P-R-76757-1-2,P-R-54903-1-3,P-R-26146-7-17,P-D-29635-1-1,P-D-27087-1-9,P-R-79688-1-3,P-R-53532-1-5,P-R-51436-1-6,P-R-51427-18-12,P-R-40464-18-9,P-X-98518-3-7,P-R-38390-18-21,blockedgraphicsadapter_rev2:174674,P-R-35099-2-4,P-R-61408-18-3,P-R-55746-2-5,P-R-53512-1-4,P-R-46974-18-18,P-R-38953-1-11,P-R-36551-18-18,P-R-71414-1-6,P-R-40253-6-19,P-R-40254-6-18,P-R-35401-6-7,P-R-32107-22-22,P-R-39146-14-15,P-R-39147-14-20,P-R-28546-6-11,P-R-28165-6-28,P-R-24980-8-48,P-R-24390-5-12,P-R-18279-2-65,P-D-34200-4-5,P-R-51145-2-7,P-R-29928-2-20,P-R-67932-1-4,P-R-67201-1-4,P-R-64545-1-4,P-R-64035-1-4,P-R-53515-18-9,P-R-53280-1-6,P-R-52247-1-5,P-R-51958-1-5,P-R-51842-1-5,P-R-51277-2-6,P-R-47451-18-20,P-R-45919-18-19,P-R-45085-18-12,P-R-41442-18-18,P-R-38085-12-9,P-R-18744-6-22,P-D-34239-1-6,P-R-1034169-10-7,P-E-28677-2-3,P-R-55122-8-8,P-R-50255-10-9,P-R-44907-1-9,P-R-45314-10-16,P-R-44965-C1-6,P-E-38231-C1-4,P-R-94560-14-12,P-R-94189-14-13,P-R-93882-14-26,P-R-54728-16-23,P-R-54698-16-16,P-R-54658-18-19,P-R-38306-18-3,P-R-35717-5-30,P-R-34019-4-3,P-X-53845-1-9,P-X-53772-1-3,P-X-51790-1-3,P-E-42700-2-4,P-R-1025232-24-9,P-R-71358-1-4,P-R-70941-1-4,P-R-69065-1-3,P-R-67160-1-7,P-R-59781-1-4,P-R-55631-1-4,P-R-54215-1-4,P-R-53751-1-4,P-R-53752-1-4,P-R-53526-1-4,P-R-52110-1-4,P-R-49765-15-32,P-R-48818-17-25,P-R-50679-1-4,P-R-50486-18-12,P-R-44830-18-13,P-R-49416-4-14,P-R-48457-2-6,P-R-47974-16-18,P-R-46544-18-11,P-R-45609-14-6,P-R-45197-2-6,P-R-44046-18-11,P-R-44015-18-20,P-R-43723-2-6,P-R-41742-18-32,P-R-40980-18-16,P-R-40359-2-10,P-R-39029-5-18,P-R-38835-18-48,P-R-37676-18-46,P-R-36310-4-5,P-R-35945-10-5,P-R-35143-4-4,P-R-33553-4-6,P-R-33536-12-13,P-R-29809-1-6,P-R-26968-3-9,fiser190:49498,happy03172020-1:61977,happy02062020-0:28428,P-R-53545-4-5,P-R-50711-18-11,P-R-49736-6-22,P-R-48467-18-18,P-R-32106-7-33,P-R-30085-1-9,P-R-29138-38-83,P-R-29315-36-69,P-R-25009-1-8,P-R-24363-1-12,P-R-21631-10-64,P-R-19898-1-22,P-R-19814-1-62,P-R-19012-1-57,P-X-1015554-1-5,P-X-50220-1-3,P-X-49730-1-3,P-R-69347-1-5,P-R-64574-1-4,P-R-54116-1-4,P-R-53585-18-18,P-R-52594-18-5,P-R-52386-1-4,P-R-50980-2-4,P-R-50938-1-4,P-R-50152-18-10,P-R-49175-18-22,P-R-47260-18-23,P-R-44156-18-26,P-R-43284-18-19,P-R-43285-12-22,P-R-42482-1-4,P-R-40990-12-15,P-R-39333-18-28,P-R-35439-12-21,P-R-33215-18-19,P-R-31352-12-25,P-D-34269-2-5,grski455:227436,gruse488:19772,grico406:19777,P-R-49830-18-15,P-R-40586-18-27,P-R-32996-18-24,P-D-40316-9-5,P-R-50429-18-8,P-R-65295-18-30,P-R-61861-1-4,P-R-61737-1-4,P-R-51777-18-8,P-R-50920-1-6,P-R-50366-18-19,P-R-35985-14-20,P-R-35891-18-5,P-R-32004-2-5,P-R-68336-2-4,P-R-67286-2-6,P-R-51513-2-4,P-R-79963-1-2,P-R-52043-1-3,P-R-51764-1-4,P-R-49388-2-6,P-R-48335-4-16,P-R-47308-3-9,P-R-42392-2-4,P-R-39073-1-5,P-R-1009855-12-14,P-R-98856-18-48,P-R-38410-18-22,P-X-1006174-1-5,P-R-66436-1-4,P-R-62873-1-4,P-R-51097-1-5,P-R-50706-18-7,P-R-50055-18-7,P-R-49315-18-5,P-R-42660-18-35,P-R-36649-8-9,oeall843:258502,P-R-42379-2-3,P-R-42378-2-3,P-R-66539-1-4,P-R-66538-1-4,P-R-65278-1-4,P-R-65279-1-4,P-R-59180-1-4,P-R-48070-1-5,P-R-47386-1-4,P-R-55342-2-2,P-R-53377-2-6,P-R-52481-2-5,P-R-49759-2-8,P-R-46100-20-9,P-R-38510-2-10,P-R-37550-20-13,P-R-32186-C27-29,P-R-58135-2-4,P-R-56618-1-3,P-R-56027-1-4,P-R-61718-18-3,P-R-46145-18-18,P-R-33892-1-8,P-R-33696-1-5,P-R-55749-1-4,P-R-53662-1-4,P-R-52246-1-4,P-R-52245-1-4,P-R-52238-1-5,P-R-43644-6-13,P-R-39912-1-2,P-R-39283-4-10,P-R-50380-18-18,P-R-50379-18-17,P-R-1062317-8-6,P-R-1062316-8-6,P-R-68146-1-5,P-R-63409-1-5,P-R-50542-18-14,P-R-50500-18-16,P-R-48365-18-24,P-R-48161-18-32,P-R-46597-1-4,P-R-33737-1-4,P-E-29662-C1-3,P-R-29303-2-19,P-R-56654-2-4,P-R-53256-2-11,P-R-51703-1-5,P-R-50133-2-9,P-R-47242-18-11,P-R-46410-1-5,P-R-45550-C17-46,P-R-45490-16-9,P-R-44885-18-20,P-R-42512-1-2,P-R-40169-8-13,P-R-39700-2-7,P-R-37313-18-22,P-R-36664-4-3,P-R-35476-2-5,P-R-35407-4-3,P-R-35237-14-11,P-R-35150-2-4,P-R-35129-2-4,P-R-35056-4-5,P-R-34889-8-4,P-R-34044-2-4,P-R-33718-6-5,P-R-33459-1-5,P-R-30292-4-7,P-R-28644-1-4,P-R-24037-1-6,P-R-23445-3-6,P-R-23434-3-7,P-R-23403-3-8,P-R-18513-1-30,P-D-34699-4-4,P-D-34697-2-4,P-D-34675-1-4,P-D-34673-1-4,P-D-34654-1-4,P-D-34587-3-5,P-D-34266-1-4,P-D-34262-1-5,P-D-34260-1-5,P-D-34258-2-5,P-D-32465-1-5,P-D-32459-2-4,P-D-32458-5-4,P-R-69529-1-5,P-R-65011-1-3,P-R-53622-18-4,P-R-50541-2-7,P-R-49893-22-9,P-R-36932-2-13,P-R-69232-18-13,P-R-23681-2-7,P-D-32502-2-3,P-D-32501-2-3,P-D-32415-2-3,P-R-64513-18-10,P-R-51916-84-31,P-R-1074487-1-3,P-R-1072014-2-4,P-R-1069769-2-4,P-R-1068115-1-3,P-R-23746-29-39,P-R-1059494-2-4,P-R-1045118-2-4,P-R-25269-14-21,P-R-1044408-1-3,P-R-1044141-7-9,P-R-1042833-1-3,P-R-1041682-2-4,P-R-1037887-1-3,P-R-1037879-1-3,P-R-1036293-1-3,P-R-1036292-1-3,P-R-1036289-2-4,P-R-1036288-1-3,P-R-1036068-2-4,P-R-1035933-2-4,P-R-1035149-2-4,P-R-1033817-1-3,P-R-1028168-1-3,P-R-1009717-3-5,P-R-1000061-2-4,P-R-117548-2-4,P-R-111682-1-3,P-R-105731-36-38,P-R-104435-13-15,P-R-100294-1-3,P-R-99633-1-3,P-R-98929-2-4,P-R-98250-1-3,P-R-94299-1-3,P-R-93077-1-3,P-R-86118-1-3,P-R-80517-6-8,P-R-78112-4-6,P-R-77140-2-4,P-R-76918-2-4,P-R-76721-1-3,P-R-75440-2-4,P-R-73676-1-3,P-R-72449-7-10,P-R-72030-4-6,P-R-68069-2-4,P-R-66975-1-3,P-R-65567-1-3,P-R-62212-2-4,P-R-60602-2-4,P-R-52633-1-3,P-R-52171-2-4,P-R-52011-2-4,P-R-51921-8-10,P-R-51258-6-8,P-R-50752-2-4,P-R-50681-2-4,P-R-50599-4-6,P-R-50596-4-8,P-R-50553-1-3,P-R-49597-3-5,P-R-49458-2-4,P-R-48530-5-7,P-R-47948-1-4,P-R-46580-3-5,P-R-46484-10-12,P-R-46122-1-3,P-R-45858-2-4,P-R-43966-2-4,P-R-43502-19-21,P-R-38248-17-21,P-R-41430-1-3,P-R-40751-8-10,P-R-40273-4-6,P-R-39238-2-4,P-R-38682-3-5,P-R-37588-2-4,P-R-34355-8-10,P-R-26266-4-9,P-R-26834-3-8,P-R-24662-16-22,P-R-27479-6-11,P-R-26056-7-15,P-R-27006-7-12,P-R-30338-3-7,P-R-30178-78-80,P-R-30053-7-9,P-R-27458-1-5,P-R-25822-16-19,P-R-25083-6-9,P-R-24690-34-38,P-R-24689-2-5,P-R-24666-2-5,P-R-24663-6-11,P-R-24659-7-10,P-R-23744-7-9,P-R-23739-7-9,P-R-23736-14-17,P-R-23734-7-9,P-R-23730-21-24,P-R-23723-10-12,P-D-32588-1-3,P-D-32534-1-3,P-D-32524-1-3,P-D-32518-1-3,P-D-32512-1-3,P-D-32509-1-3,P-D-32486-1-3,P-D-32485-1-4,P-D-32484-1-4,P-D-32405-1-3,P-R-49160-12-12,P-R-47601-18-13,P-R-46834-12-14,P-R-46202-18-11,P-R-44018-18-13,P-R-43355-18-12,P-R-35337-16-7,P-R-33916-1-5,P-R-33580-8-9,P-X-117400-1-3,P-R-59175-18-4,P-R-53292-14-10,P-R-49130-18-23,P-R-46913-18-8,P-R-37449-18-15,uxmediumiconluminance:339386,P-R-48549-18-11,P-R-19262-1-12,P-E-44774-2-9,P-R-44869-16-16,P-R-33918-1-11,P-R-81720-1-2,P-R-58406-1-5,P-D-50697-2-4,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-6"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\DeviceId = "001880095ED41F7C"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|7"	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\VersionId = "uint16_t\|0"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\ClickToRun\C2RClient	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\ClickToRun\C2RClient\C2RClientReturnCode\7684_Status = "started"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.6 = 32207d207d207d207d207d207d207d2c205c2241744d656e74696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446f63756d656e744163746976697479496e746567726174696f6e5c22203a207b205c224576656e74735c22203a207b205c224164645265636f7665726564416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f6365737341744d656e74696f6e4e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6d6d656e74734e6f74696669636174696f6e436f6c6c6563746f7252656d6f766564436f6d6d656e74735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2250726f63657373436f6d6d656e74734e6f74696669636174696f6e734c6973745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22536176654c6f67466f725265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22437265617465446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c657465436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22446973636172644c6f63616c416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574655265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2243726561746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c65746541744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e436f6d6d656e7441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224372656174654d6f6465726e41744d656e74696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e4c6f6746726f6d5265636f766572795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2244656c6574654d6f6465726e5265706c7941637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225064616c6d446f63756d656e7441637469766974794c6f674d616e616765725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22456e73757265446f63756d656e744163746976697479436170747572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e737572654c6f67507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d6574726f4f70656e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f466f72417574686f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437265617465556e69717565417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243726561746555736572496e666f46726f6d417574686f72566563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224973436c6f7564446f63756d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365745361766564507265526571735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655265766973696f6e53657441637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574436f6d6d656e74436f6e74656e744964656e7469666965725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f67436f6d6d656e744174747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472794372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536176654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2253657453617665645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224162616e646f6e4c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225461736b4372656174696f6e41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22526561737369676e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656f70656e5461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d706c6574655461736b41637469766974795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f704261636b73746167655c22203a207b205c224576656e74735c22203a207b205c22536176654173526563656e74436c69636b65645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665417344656661756c745365727669636553656c656374696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f70656e526563656e74446f63756d656e747356696577436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e526563656e74446f63756d656e7473566965775769746846656174757265456e61626c6564436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22424743616c634d616e6167657250726f6365737353657456616c75657350726f635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22424743616c6349646c655461736b46457865637574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506c6163657347726f757065724163636f756e74496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2247657474696e67537461727465644d5255536c61624765744d72754461746554696d6547726f7570547970655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e526563656e744c6f636174696f6e7356696577436c69636b65645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e617669676174696f6e5265616453697465526f6f74427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e617669676174696f6e52656164446f634c6962466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224f666669636553706163655c22203a207b205c225375624e616d657370616365735c22203a207b205c224465736b746f704261636b73746167654e617669676174696f6e5c22203a207b205c224576656e74735c22203a207b205c224c617a794c6f616446696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224c6f616446726f6d46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2253617665496e746f46696c6543616368655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2252656164546869735043526f6f745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22526561644c6f63616c466f6c6465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225265616453697465526f6f74427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224765744974656d57656244617655726c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2247657452656d6f74654974656d496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2252656164446f634c6962466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526561644d696772617465644f4443466f6c646572427956726f6f6d5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d2c205c22504358506572736f6e6150686f746f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f757453706163655c22203a207b205c224576656e74735c22203a207b205c22557064617465506c616365735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224372656174655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22486964655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225365744d72754c697374466f72486f6d65506167655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c65616e75705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536861726564576974684d65506f70756c6174654c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225570646174654d52554974656d735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f70656e4469736d6973735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e65774469736d6973735c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c224465736b746f704261636b73746167655c22203a207b205c224576656e74735c22203a207b205c224261636b73746167654469736d69737365645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f76657279436f6d7061726557697468556e736176656456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f7665727944656c657465556e736176656456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f766572794f70656e556e736176656456657273696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224175746f5265636f76657279506f70756c617465556e736176656456657273696f6e4c6973745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496e69744e65774e6176466f6c6465725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224e6577536572766963654c6973745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c225368617265506f696e7453697465735c22203a207b205c224576656e74735c22203a207b205c2247726f75707353697465735265717565737449636f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e745369746573496e697469616c697a655369746573436f6c6c656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e74536974657350726f63657373526573756c74466f724964656e746974795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465734964656e74697479436163686552657175657374526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465735265717565737453697465734361636865645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465735265717565737453697465734173796e6350726f63657373526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225368617265506f696e7453697465735265717565737453697465734173796e635c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224372656174654c6f636174696f6e735c22203a207b205c224576656e74735c22203a207b205c2244656661756c744964656e74697479456d7074795c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2253686172696e674c6567616379436c69656e745c22203a207b205c224576656e74735c22203a207b205c22476574446174615c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486f6d65506167655c22203a207b205c224576656e74735c22203a207b205c22506c6163654368616e6765536c6162436f6e646974696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e53686f77486f6d65506167655c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c225365617263685c22203a207b205c224576656e74735c22203a207b205c225365656e4279557365725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224f666669636553746172745c22203a207b205c224576656e74735c22203a207b205c22536574757054656d706c61746550726f706572746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243757272656e745549416374697665506c6163654368616e67655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22547269676765725468756d626e61696c416374696f6e52756e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e744e6f74696669636174696f6e735c22203a207b205c224576656e74735c22203a207b205c2252656769737465724f6e49646c65466561747572654761746544697361626c65645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d7275536572766963654170695c22203a207b205c225375624e616d657370616365735c22203a207b205c22446f63756d656e74735c22203a207b205c224576656e74735c22203a207b205c2252656164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225772697465526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e526571756573745375636365656465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22506c616365735c22203a207b205c224576656e74735c22203a207b205c2252656164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225772697465526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e526571756573745375636365656465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d207d207d2c205c224d736f53686172696e675c22203a207b205c224576656e74735c22203a207b205c22434d736f53686172696e675365727669636548656c706572456e64476574486f73744361706162696c69746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572476574486f73744361706162696c69746965735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e6447657455736572417474726962757465735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657455736572417474726962757465735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e644765744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065724765744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e645365744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065725365744c696e6b735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e644765745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065724765745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572456e645365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c7065725365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572436865636b5065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657453686172696e67496e666f726d6174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c706572426567696e5365745065726d697373696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f53686172696e675365727669636548656c70657247657453686172696e6756657273696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d6f6465726e4261636b73746167655c22203a207b205c224576656e74735c22203a207b205c224261636b737461676550616765436f6e74726f6c55736572437265617465436f6e74726f6c557365725c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224465736b746f704261636b73746167654e61766967617469	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t\|9"	integrator.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0051-ABCDEFFEDCBA}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0010-ABCDEFFEDCBB}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xesc\shell	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0063-ABCDEFFEDCBA}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBB}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBA}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C8D258D0-9239-3C8D-A2F1-F483968220F6}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpe\shell\PlayWithVLC	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg1\DefaultIcon	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Programmable	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0007-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.potm\ShellEx	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\00006109C80000000100000000F01FEC\SourceList	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBC}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.OpenDocuments.4\CLSID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AC0714F2-3D04-11D1-AE7D-00A0C90F26F4}\1.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.vlt	Un_A.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0013-0001-0062-ABCDEFFEDCBA}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBA}	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\WOW6432NODE\INTERFACE\{2EB31403-EBE0-41EA-AE91-A1953104EA55}\TYPELIB	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0085-ABCDEFFEDCBB}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBB}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0031-ABCDEFFEDCBC}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\OneIndex.ShellFolder.1	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{315154AD-F287-33EE-AEDE-8781545C713F}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\FILESYNCCLIENT.AUTOPLAYHANDLER.1\CLSID	OneDriveSetup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.669\shell\AddToPlaylistVLC	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0048-ABCDEFFEDCBB}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Control	MsiExec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0004-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F24E-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.ram\DefaultIcon	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0041-ABCDEFFEDCBA}	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBC}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62B4D041-4667-40B6-BB50-4BC0A5043A73}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F6BC-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{38954A26-B100-43F6-B5A8-C03AEF8F5C90}\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\WOW6432NODE\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\PROGID	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_CLASSES\INTERFACE\{10C9242E-D604-49B5-99E4-BF87945EF86C}\TYPELIB	OneDriveSetup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command\ = "\"C:\\Program Files\\Java\\jdk1.8.0_66\\bin\\javaw.exe\" -jar \"%1\" %*"	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0050-ABCDEFFEDCBA}\INPROCSERVER32	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{1C72E0F9-FA29-3C15-ABEA-794E2D17834F}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64654B35-A024-4807-89D3-C6FDB5A260C7}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6F81EA95-074E-48D4-AA96-62197E0AE96F}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.cue	Un_A.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBB}	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0088-ABCDEFFEDCBC}	schtasks.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0072-ABCDEFFEDCBC}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0037-ABCDEFFEDCBB}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBC}	schtasks.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDFE337F-4987-4EC8-BDE3-133FA63D5D85}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C7D9681C-4F5C-3840-BFCE-C91510B56181}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{796A2C2D-5B11-4FB5-9077-56D5E674972B}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0045-ABCDEFFEDCBC}	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1884	schtasks.exe
1884	schtasks.exe
5764	OneDriveSetup.exe
5764	OneDriveSetup.exe
4496	jp2launcher.exe
4496	jp2launcher.exe
708	OneDriveSetup.exe
708	OneDriveSetup.exe
708	OneDriveSetup.exe
708	OneDriveSetup.exe
708	OneDriveSetup.exe
708	OneDriveSetup.exe
708	OneDriveSetup.exe
708	OneDriveSetup.exe
7684	OfficeClickToRun.exe
7684	OfficeClickToRun.exe
4768	msiexec.exe
4768	msiexec.exe
5464	setup.exe
5464	setup.exe
5464	setup.exe
5464	setup.exe
5464	setup.exe
5464	setup.exe
6696	MsiExec.exe
6696	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
7500	MsiExec.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
7172	explorer.exe
5420	taskmgr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5820	MicrosoftEdgeCP.exe
5820	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	firefox.exe
Token: SeDebugPrivilege	5044	firefox.exe
Token: SeDebugPrivilege	5044	firefox.exe
Token: SeDebugPrivilege	5044	firefox.exe
Token: SeDebugPrivilege	5044	firefox.exe
Token: SeShutdownPrivilege	4996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4996	msiexec.exe
Token: SeSecurityPrivilege	4768	msiexec.exe
Token: SeCreateTokenPrivilege	4996	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4996	msiexec.exe
Token: SeLockMemoryPrivilege	4996	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4996	msiexec.exe
Token: SeMachineAccountPrivilege	4996	msiexec.exe
Token: SeTcbPrivilege	4996	msiexec.exe
Token: SeSecurityPrivilege	4996	msiexec.exe
Token: SeTakeOwnershipPrivilege	4996	msiexec.exe
Token: SeLoadDriverPrivilege	4996	msiexec.exe
Token: SeSystemProfilePrivilege	4996	msiexec.exe
Token: SeSystemtimePrivilege	4996	msiexec.exe
Token: SeProfSingleProcessPrivilege	4996	msiexec.exe
Token: SeIncBasePriorityPrivilege	4996	msiexec.exe
Token: SeCreatePagefilePrivilege	4996	msiexec.exe
Token: SeCreatePermanentPrivilege	4996	msiexec.exe
Token: SeBackupPrivilege	4996	msiexec.exe
Token: SeRestorePrivilege	4996	msiexec.exe
Token: SeShutdownPrivilege	4996	msiexec.exe
Token: SeDebugPrivilege	4996	msiexec.exe
Token: SeAuditPrivilege	4996	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4996	msiexec.exe
Token: SeChangeNotifyPrivilege	4996	msiexec.exe
Token: SeRemoteShutdownPrivilege	4996	msiexec.exe
Token: SeUndockPrivilege	4996	msiexec.exe
Token: SeSyncAgentPrivilege	4996	msiexec.exe
Token: SeEnableDelegationPrivilege	4996	msiexec.exe
Token: SeManageVolumePrivilege	4996	msiexec.exe
Token: SeImpersonatePrivilege	4996	msiexec.exe
Token: SeCreateGlobalPrivilege	4996	msiexec.exe
Token: SeBackupPrivilege	1872	vssvc.exe
Token: SeRestorePrivilege	1872	vssvc.exe
Token: SeAuditPrivilege	1872	vssvc.exe
Token: SeBackupPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeShutdownPrivilege	1780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1780	msiexec.exe
Token: SeCreateTokenPrivilege	1780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1780	msiexec.exe
Token: SeLockMemoryPrivilege	1780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1780	msiexec.exe
Token: SeMachineAccountPrivilege	1780	msiexec.exe
Token: SeTcbPrivilege	1780	msiexec.exe
Token: SeSecurityPrivilege	1780	msiexec.exe
Token: SeTakeOwnershipPrivilege	1780	msiexec.exe
Token: SeLoadDriverPrivilege	1780	msiexec.exe
Token: SeSystemProfilePrivilege	1780	msiexec.exe
Token: SeSystemtimePrivilege	1780	msiexec.exe
Token: SeProfSingleProcessPrivilege	1780	msiexec.exe
Token: SeIncBasePriorityPrivilege	1780	msiexec.exe
Token: SeCreatePagefilePrivilege	1780	msiexec.exe
Token: SeCreatePermanentPrivilege	1780	msiexec.exe
Token: SeBackupPrivilege	1780	msiexec.exe
Token: SeRestorePrivilege	1780	msiexec.exe
Token: SeShutdownPrivilege	1780	msiexec.exe
Token: SeDebugPrivilege	1780	msiexec.exe
Token: SeAuditPrivilege	1780	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
4996	msiexec.exe
1780	msiexec.exe
1780	msiexec.exe
5992	msiexec.exe
5992	msiexec.exe
4996	msiexec.exe
1708	msiexec.exe
1708	msiexec.exe
7428	msiexec.exe
7428	msiexec.exe
7084	msiexec.exe
7084	msiexec.exe
5044	firefox.exe
5044	firefox.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
5420	taskmgr.exe
7172	explorer.exe
7172	explorer.exe
7172	explorer.exe
7172	explorer.exe
7172	explorer.exe
7172	explorer.exe
7172	explorer.exe
7172	explorer.exe
7172	explorer.exe
5420	taskmgr.exe
7172	explorer.exe
7172	explorer.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
5044	firefox.exe
4564	OfficeClickToRun.exe
4496	jp2launcher.exe
5888	integrator.exe
6412	Uninstall.exe
6440	Uninst.exe
7684	OfficeClickToRun.exe
6480	uninstall.exe
6764	Un_A.exe
4828	MicrosoftEdge.exe
5820	MicrosoftEdgeCP.exe
5820	MicrosoftEdgeCP.exe
8080	SearchUI.exe
6228	SearchUI.exe
6508	SearchUI.exe
2928	SearchUI.exe
2928	SearchUI.exe
2928	SearchUI.exe
2928	SearchUI.exe
2928	SearchUI.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
5044	firefox.exe
780	firefox.exe
5256	firefox.exe
7172	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5036 wrote to memory of 5044	5036	firefox.exe	75
PID 5044 wrote to memory of 692	5044	firefox.exe	76
PID 5044 wrote to memory of 692	5044	firefox.exe	76
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 456	5044	firefox.exe	77
PID 5044 wrote to memory of 232	5044	firefox.exe	78
PID 5044 wrote to memory of 232	5044	firefox.exe	78
PID 5044 wrote to memory of 232	5044	firefox.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\BALLER.png
1⤵
PID:4188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.0.1149124576\2088830442" -parentBuildID 20221007134813 -prefsHandle 1668 -prefMapHandle 1660 -prefsLen 20810 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3cdf3b0-5bdf-40b3-82bd-f82425dd711f} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 1748 20119217558 gpu
    3⤵
    PID:692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.1.1234194908\1773917396" -parentBuildID 20221007134813 -prefsHandle 2092 -prefMapHandle 2088 -prefsLen 20891 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53decc34-114e-423f-9c97-0eb796e44c26} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 2104 2010ca6f858 socket
    3⤵
    PID:456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.2.19618905\1186120807" -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3028 -prefsLen 20974 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {afb43c86-9fcd-4759-b50d-48733ddc2d5a} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 3040 20118095858 tab
    3⤵
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.3.1938892441\1777991917" -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3668 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {faa8d6dd-65aa-4e31-890f-2a1bf5506454} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 3684 2011cee7258 tab
    3⤵
    PID:1172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.4.550531688\802513621" -childID 3 -isForBrowser -prefsHandle 3732 -prefMapHandle 3700 -prefsLen 26484 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {864ae43d-beab-4d45-b247-320c54583303} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 3716 2010ca62258 tab
    3⤵
    PID:852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.5.946016798\299726921" -childID 4 -isForBrowser -prefsHandle 2676 -prefMapHandle 2680 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {87f7aea0-bd11-45b8-9ce4-ca57abf2df6a} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 4756 2011df86858 tab
    3⤵
    PID:3252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.7.870388303\745496301" -childID 6 -isForBrowser -prefsHandle 4900 -prefMapHandle 4896 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {397b598b-d9bb-4337-8200-0589a9c6b4ae} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5112 2011e2f5558 tab
    3⤵
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.6.374737059\1415931246" -childID 5 -isForBrowser -prefsHandle 4976 -prefMapHandle 4972 -prefsLen 26622 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f366d045-f194-41a8-be70-1a4e567cd123} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 4988 2011e2f8858 tab
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.8.1092924857\696256540" -childID 7 -isForBrowser -prefsHandle 4184 -prefMapHandle 5480 -prefsLen 26639 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d44567ee-ddbe-4a8c-82b0-079da94404a6} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 2876 2011e5c0058 tab
    3⤵
    PID:3244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.9.1554299124\778927777" -childID 8 -isForBrowser -prefsHandle 4184 -prefMapHandle 5620 -prefsLen 26814 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fe82fbf-a923-4456-ac88-31ef93d0a7cb} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 3352 2011de28558 tab
    3⤵
    PID:4000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.10.470191080\540576167" -childID 9 -isForBrowser -prefsHandle 4712 -prefMapHandle 4848 -prefsLen 27324 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c231903-f8eb-4e71-b42b-b958c44a95d6} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5620 2010ca6be58 tab
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.11.16748324\1657285452" -childID 10 -isForBrowser -prefsHandle 5324 -prefMapHandle 4452 -prefsLen 27429 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df2aa328-7231-4593-b7c7-96db5a183273} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5332 2010ca69f58 tab
    3⤵
    PID:2084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.12.364008822\1819426025" -childID 11 -isForBrowser -prefsHandle 5816 -prefMapHandle 2776 -prefsLen 27810 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf7f2d54-ec30-41fd-95bf-3cb86376022d} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 2772 2011d935e58 tab
    3⤵
    PID:8096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.13.1684422819\1439883757" -childID 12 -isForBrowser -prefsHandle 2552 -prefMapHandle 4048 -prefsLen 28033 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae0bb26c-7a0d-495a-a9dc-ab9d989d724c} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 2724 2011de04a58 tab
    3⤵
    PID:7048

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 1
1⤵
PID:1384

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" LanguagePackInstaller
1⤵
PID:3404

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 1
1⤵
PID:2900

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {26A24AE4-039D-4CA4-87B4-2F86418066F0}
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Sets file execution options in registry
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6088
- C:\Windows\Installer\MSIAD34.tmp
  "C:\Windows\Installer\MSIAD34.tmp" ProductCode={26A24AE4-039D-4CA4-87B4-2F86418066F0}
  2⤵
  PID:1884
- - C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe" -wait -fix -shortcut -silent
    3⤵
    PID:5308
  - - C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_66" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNjZcbGliXGRlcGxveS5qYXIALURqYXZhLnNlY3VyaXR5LnBvbGljeT1maWxlOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF82NlxsaWJcc2VjdXJpdHlcamF2YXdzLnBvbGljeQAtRHRydXN0UHJveHk9dHJ1ZQAtWHZlcmlmeTpyZW1vdGUALURqbmxweC5ob21lPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF82NlxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF82NlxsaWJcamF2YXdzLmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNjZcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzY2XGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNjZcYmluXGphdmF3LmV4ZQ== -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4496
- - C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
    "C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update
    3⤵
    PID:5204
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe" /x {4A03706F-666A-4037-7777-5F2748764D10} /qn
      4⤵
      PID:5772
- \??\c:\Windows\syswow64\MsiExec.exe
  c:\Windows\syswow64\MsiExec.exe -Embedding 17D5DE997C4D3F02A4F18C41C9A87A20 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:5736
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6184
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5164
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6220
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6276
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:6372
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"
    3⤵
    PID:6424
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6488
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6644
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"
    3⤵
    PID:5688
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"
    3⤵
    PID:6684
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4824
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6824
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:6780
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:6928
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6988
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7032
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"
    3⤵
    PID:7140
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"
    3⤵
    PID:5852
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4716
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6296
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"
    3⤵
    PID:6364
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"
    3⤵
    PID:6432
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6484
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6604
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"
    3⤵
    PID:6656
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:6100
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6720
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6728
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6732
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6796
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6872
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7000
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6988
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7032
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6976
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6188
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4716
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6256
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6268
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6428
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6480
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6632
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:168
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5180
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6672
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6788
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6756
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6824
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6908
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6912
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6968
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7016
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7116
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6180
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6236
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6280
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6404
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6328
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6472
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"
    3⤵
    PID:6452
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"
    3⤵
    PID:6636
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6652
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5208
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"
    3⤵
    PID:6700
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"
    3⤵
    PID:6728
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6776
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6924
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"
    3⤵
    PID:6980
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"
    3⤵
    PID:6892
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6896
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:7128
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"
    3⤵
    PID:5696
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"
    3⤵
    PID:6184
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6844
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:2040
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6264
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:7164
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Drops file in Windows directory
      PID:6364
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"
    3⤵
    PID:6456
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"
    3⤵
    PID:6472
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5900
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6604
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6524
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:6660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Drops file in Windows directory
      PID:6656
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:6716
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"
    3⤵
    PID:6672
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"
    3⤵
    PID:4824
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6732
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"
    3⤵
    PID:6852
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"
    3⤵
    - Drops file in Windows directory
    PID:6924
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"
    3⤵
    PID:6528
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"
    3⤵
    PID:6964
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6936
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7056
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"
    3⤵
    PID:6152
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"
    3⤵
    PID:5696
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6188
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Drops file in Windows directory
      PID:6236
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6228
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:4716
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6416
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6284
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6484
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6632
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6648
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5180
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6704
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6736
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6868
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6796
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6880
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6568
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6960
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6980
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6900
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7060
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7020
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:7056
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:4232
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5696
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6844
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6188
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2040
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6280
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6296
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6368
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6392
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6432
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6500
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:5528
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:168
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6644
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:5212
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6696
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6760
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    PID:6544
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"
    3⤵
    - Drops file in Windows directory
    PID:6932
- - \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:7000
- - \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    PID:6892
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 927078219F85DBCBB919BB0A3CE25CEF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2416
- - C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe
    "C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe" -standalone:temp
    3⤵
    - Executes dropped EXE
    PID:6784
  - - C:\Windows\Temp\ose00000.exe
      "C:\Windows\Temp\ose00000.exe" -standalone
      4⤵
      Executes dropped EXE
      PID:6812
- - \??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    - Drops file in System32 directory
    PID:6724
- - \??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe
    "c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:6192
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:7140
- \??\c:\Windows\System32\MsiExec.exe
  c:\Windows\System32\MsiExec.exe -Embedding 3ED9AE9228C1EDB905B47B3DB670D6AA E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:7272
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 56D16EED7DBD1F473FA696F2CEB4AFE7
  2⤵
  - Loads dropped DLL
  PID:7460
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0257352E9B60DAB3A7AFABA2943E70A2 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:4916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EF32DD960BB04E724E8214C5D4D6C08F
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:6696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 38F04587F1BDDC201A94634E79CBE727 E Global\MSI0000
  2⤵
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:7500
- C:\Windows\Installer\MSID812.tmp
  "C:\Windows\Installer\MSID812.tmp" /b 3 120 0
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
  2⤵
  - Executes dropped EXE
  PID:2212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {64A3A4F4-B792-11D6-A78A-00B0D0180660}
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1780

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" scenario=install scenariosubtype=ARP sourcetype=None productstoremove=ProPlusRetail.16_en-us_x-none culture=en-us version.16=16.0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4564

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" /uninstall
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5764
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe /uninstall /permachine /silent /childprocess /enableOMCTelemetry /cusid:S-1-5-21-3853465373-1718857667-1861325682-1000
  2⤵
  PID:800
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe
  C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry
  2⤵
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:708
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall
    3⤵
    PID:7160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
PID:6112

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"
1⤵
PID:5248

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {9BE518E6-ECC6-35A9-88E4-87755C07200F}
1⤵
- Suspicious use of FindShellTrayWindow
PID:5992

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
integrator.exe /U /Extension /Msi /License PRIDName=ProPlusRetail.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"
1⤵
- Sets file execution options in registry
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5888
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"
  2⤵
  PID:5772
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"
  2⤵
  PID:5744
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"
  2⤵
  PID:5872
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"
  2⤵
  - Executes dropped EXE
  - Registers COM server for autorun
  - Installs/modifies Browser Helper Object
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1884

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5872

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {AC76BA86-7AD7-1033-7B44-AC0F074E4100}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1708

C:\Program Files\7-Zip\Uninstall.exe
"C:\Program Files\7-Zip\Uninstall.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6412
- C:\Users\Admin\AppData\Local\Temp\7zC60A890C\Uninst.exe
  C:\Users\Admin\AppData\Local\Temp\7zC60A890C\Uninst.exe /N /D="C:\Program Files\7-Zip\"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6440

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:7064

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6488

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /standalonesystem
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:7684
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates"
  2⤵
  PID:7740
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates 2.0"
  2⤵
  PID:7776
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office Subscription Maintenance"
  2⤵
  PID:7812
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Office ClickToRun Service Monitor"
  2⤵
  PID:7848
- C:\Windows\system32\schtasks.exe
  schtasks.exe /Delete /F /tn "Microsoft\Office\Microsoft Office Touchless Attach Notification"
  2⤵
  PID:7884

C:\Program Files\VideoLAN\VLC\uninstall.exe
"C:\Program Files\VideoLAN\VLC\uninstall.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:6480
- C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\VideoLAN\VLC\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6764
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"
    3⤵
    PID:6776
  - - C:\Windows\system32\regsvr32.exe
      /s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"
      4⤵
      Modifies registry class
      PID:6996

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:6568
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  - Drops file in Windows directory
  PID:6652

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {64A3A4F4-B792-11D6-A78A-00B0D0180660}
1⤵
- Suspicious use of FindShellTrayWindow
PID:7428

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --uninstall --system-level
1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:5464
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7a3027688,0x7ff7a3027698,0x7ff7a30276a8
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --uninstall
  2⤵
  - Enumerates system info in registry
  PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff839609758,0x7ff839609768,0x7ff839609778
    3⤵
    PID:2888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1732,i,2007311895456898379,5994247121450568558,131072 /prefetch:8
    3⤵
    PID:7968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1732,i,2007311895456898379,5994247121450568558,131072 /prefetch:2
    3⤵
    PID:5864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:7724

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
PID:6600

C:\Windows\system32\msiexec.exe
"C:\Windows\system32\msiexec.exe" /qb /x {AC76BA86-7AD7-1033-7B44-AC0F074E4100}
1⤵
- Suspicious use of FindShellTrayWindow
PID:7084

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:7876

C:\Windows\System32\colorcpl.exe
"C:\Windows\System32\colorcpl.exe"
1⤵
PID:2952

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /6
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5420

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:8080

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:7172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /q /c rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013"
  2⤵
  PID:7236
- C:\Windows\system32\SystemSettingsAdminFlows.exe
  "C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 0
  2⤵
  PID:3928
- C:\Windows\system32\SystemSettingsAdminFlows.exe
  "C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 1
  2⤵
  PID:7964
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.0.1013584892\2003323409" -parentBuildID 20221007134813 -prefsHandle 1580 -prefMapHandle 1568 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {add139f0-cbaf-43d3-9e75-28c661c92b8e} 780 "\\.\pipe\gecko-crash-server-pipe.780" 1656 1c3b0ef9b58 gpu
      4⤵
      PID:7780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.1.101783238\1716002729" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1832 -prefsLen 17601 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1bd732c-c40f-4984-9d7f-12dfe20fd760} 780 "\\.\pipe\gecko-crash-server-pipe.780" 1848 1c3b1052f58 socket
      4⤵
      Checks processor information in registry
      PID:6444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:6292
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:5256
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.0.1918029300\1421504590" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1492 -prefsLen 20810 -prefMapSize 232681 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49685803-28b8-4900-bbbf-97693d14216a} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 1600 1a9d0c0de58 gpu
        6⤵
        
        PID:7652
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.1.903995402\1572523387" -parentBuildID 20221007134813 -prefsHandle 1892 -prefMapHandle 1888 -prefsLen 20855 -prefMapSize 232681 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cf84e12-624b-4537-8cc8-f0a7043fc08a} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 1904 1a9d0749658 socket
        6⤵
        Checks processor information in registry
        
        PID:3144
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.2.2063547176\968517617" -childID 1 -isForBrowser -prefsHandle 2580 -prefMapHandle 2760 -prefsLen 21296 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd44f4e9-939a-48c7-ab60-8cb9ac5da26b} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 2524 1a9d480d258 tab
        6⤵
        
        PID:6400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.3.1107849715\758755146" -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 3740 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e429ccfc-e476-45ae-b5df-e72748b9f07b} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 3712 1a9c6968758 tab
        6⤵
        
        PID:6912
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.4.1512241631\402014075" -childID 3 -isForBrowser -prefsHandle 4332 -prefMapHandle 4312 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {49b95b35-16b3-42f8-9c16-82a685c17e57} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 4344 1a9d7548358 tab
        6⤵
        
        PID:5680
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.6.79826128\1001774223" -childID 5 -isForBrowser -prefsHandle 4808 -prefMapHandle 4820 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d246dd9d-acb0-4003-bf6f-a39ea22f3d79} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 4704 1a9d2f05c58 tab
        6⤵
        
        PID:6236
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.7.1753633101\1571459071" -childID 6 -isForBrowser -prefsHandle 4940 -prefMapHandle 4944 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {483195f5-0e77-4706-964c-8ab7aa721f43} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 4928 1a9c696a858 tab
        6⤵
        
        PID:2252
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.5.1495657867\1521120985" -childID 4 -isForBrowser -prefsHandle 4668 -prefMapHandle 4664 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e36f4f0-5c29-4ab3-98fa-42875ee3dfa1} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 4680 1a9d074a258 tab
        6⤵
        
        PID:7180
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.8.761473082\370695331" -childID 7 -isForBrowser -prefsHandle 5296 -prefMapHandle 5268 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {51247e1b-4044-465f-a7ca-00702e2dc249} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 5304 1a9d84bcc58 tab
        6⤵
        
        PID:3292
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.9.110326118\1665775279" -childID 8 -isForBrowser -prefsHandle 5476 -prefMapHandle 5504 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {06e48ec3-a4dd-4b8f-b48d-a06504b0f934} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 5468 1a9d5a35e58 tab
        6⤵
        
        PID:6948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.10.743896244\1584216869" -childID 9 -isForBrowser -prefsHandle 7796 -prefMapHandle 7800 -prefsLen 26832 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a8c240c-a62b-45ef-8fbc-c75c777a7f9b} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 7784 1a9d8b52458 tab
        6⤵
        
        PID:6924
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5256.11.1733885234\902984407" -childID 10 -isForBrowser -prefsHandle 5192 -prefMapHandle 5012 -prefsLen 27097 -prefMapSize 232681 -jsInitHandle 1220 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {914d98e0-f268-4615-9c70-8c3a1a0c9da2} 5256 "\\.\pipe\gecko-crash-server-pipe.5256" 4672 1a9d90e7558 tab
        6⤵
        
        PID:6272
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:6668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    PID:7072

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:6228

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
PID:4072

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:6508

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5bd658.rbs

Filesize
48KB

MD5
4e7d1e97350b2343ace8eefa55d51f2c

SHA1
5997d55c7c5b30add561e4ed0edc42e621055940

SHA256
eab2626de3d247c2a0abaf3e66e7f9a62e05eff964f804e20b2c7f4a708ed1c2

SHA512
6492914e95c44f92c454a81759fda96f1c12be83ef4f9fa5788c47aab849d6146f4ed5df0882136bfdc54bb8d68777e780d7382859784af971834f6f832cf64a

Download Submit
C:\Config.Msi\e5bd71c.rbs

Filesize
2.4MB

MD5
501613dc7d06ca4b282ff9106b18df6f

SHA1
837799a26b9f374e27ee22a3070ff4e10f8188e1

SHA256
7448c1fae70e67d188f1fcf26859ea7d021f37bc088251fe1ce02748bd9951ea

SHA512
9d1d1cf28021358afe4ac785c3be5424fd8b181f482c8111806f3534fdbdac471021fc88b5719a167e4bc54a8d0d8d715b2ea33054b5107a2936f8353e35942f

Download Submit
C:\Config.Msi\e5bd74b.rbf

Filesize
446KB

MD5
745897fc2816625a0e5f1ac0f9af16a2

SHA1
cfa9d4dbd1a5bc728ed712cef8b3fadc903d111b

SHA256
5512cabd57b6e1fbd2b96c298d804a3795cd317f61e154aedb335f6c119eaf62

SHA512
7053e9c95b943a30006065a66830bfeb0f37dfb185fcc27019c205e3cea358a0f71ff8007cb6aa39bf61e3406e989ac8366226d83dea5e37c429a5242d1786d2

Download Submit
C:\Config.Msi\e5bd74c.rbf

Filesize
850B

MD5
485f3cd5a94355f8e6b0aa101abd9f04

SHA1
a91650f4f103fdf08c8c261cdb1746aca658229e

SHA256
ecb94457c6327a56138dee83fcd82e61352c45e7097309a2effc694e5e78d1e8

SHA512
31b1746d7491d4be907bfe966cecc43f9fac099f897f423cf0b85bef4846a325d209ab64408edfbbd110ca3d3d61644d0cd547e431ae6e6ccd5a74cd9dcaa794

Download Submit
C:\Config.Msi\e5bd74d.rbf

Filesize
11KB

MD5
7e23e2abf1e03fd0d3c0ed71d3e67201

SHA1
77e9ff622eb2b07d4eb908146251d2061895fd47

SHA256
588aa09f39b70d191b92c2414217429a2fd21c4fb7c3f21fa1d57ece2f552209

SHA512
14496dcaaccd6b00b156d26691465f6fb85da94b04d0a804ad22a8f42d992ef201c4c92b87e2c9d6e5b80ffe53049ed8b44d67ec304bd604d18f6204590c7bb3

Download Submit
C:\Config.Msi\e5bd74e.rbf

Filesize
850B

MD5
57626036538c8abbf5bc761c8ecbb274

SHA1
f3dc829a302cd7e268b566eff47b9c5b3badc33c

SHA256
aeb0afc185056f716552564e277ef8a6740a4e7f1600032153eebffae18b3ed2

SHA512
2d508dc1d441187d18502f3d470a27cc8a34af5b16a97db713a2c34801ad65eaf4e15e7b13fb216c11ef4ce505e438e4dd49c326e8217341735ecfbedbdcd330

Download Submit
C:\Config.Msi\e5bd74f.rbf

Filesize
11KB

MD5
642d05fef3999b47e67a3b979395d87d

SHA1
0806dda798421528f8e61e81ac4aadd20cc101e7

SHA256
53bb64373a30ee2b7b2d2fca25f1d0047fee7d932f351d902041b3d5fad6016b

SHA512
7f362c47552e0e31c1361f5cd81c94a7e3b1755b4c336b36275a4f42b77ddc775ad5c46e5aed5659f10beef92f228d52882b1fc421bba093373df82f110e2b2e

Download Submit
C:\Config.Msi\e5bd750.rbf

Filesize
850B

MD5
fd580865ff5b65ffeead3da78f9d244b

SHA1
f26c08181b87d1a6979f97293413d25f6f2862e3

SHA256
5256b74f3447a7fdbaab2ebe6442160dd617fb10800fd0045895b280f603604a

SHA512
5c7dd9a96db711627e4e2f0bc57bc56a1ebd22d8063cc6b8d5d10ad86104b0aaef52fc17e84ebd07d902d345931aeb33e8ba1dfc334e8da251b538e5e8fb10bd

Download Submit
C:\Config.Msi\e5bd751.rbf

Filesize
11KB

MD5
1c213c5e8828353641cef6d74ee6838d

SHA1
6e16eb31f642327afbed7b8d4ca56e791b799cca

SHA256
a1cbfc3eca8b075ce204c629bf0cf36b0add593c8a28040018319e5e2533ffdd

SHA512
7b7a222c49a95cea34d8ea005302295572a9955a396bfb51e929a83fd351a67c55c4b8c1647eeb0d4d7bf5e9b0c9502d7f4f4e75970e5b004bb72b4c5c2abf43

Download Submit
C:\Config.Msi\e5bd752.rbf

Filesize
62KB

MD5
b4c6016286bdce7c51c3634999f2ea5e

SHA1
c446378afc6b12c372bf4dbf33efa61e9f7fbbda

SHA256
a8f8ab6c63c8d4471d158010f18cb24d4d2ccea495a160cdcef95a96183ffc6a

SHA512
a121b4df2348ef53413b82c69a66ad3654aaec7d40011dfa4968f9a6b9a5e1252089f39f4961f2305a678c227abc14bac88a3674ab960fc52f71f7c3776c928d

Download Submit
C:\Config.Msi\e5bd753.rbf

Filesize
880B

MD5
dcc6434e76ccc91fa6c35df0d0d6f5ce

SHA1
ed1d50016a7db340208145d988a82ce7c126cc94

SHA256
45526926c328fd96d9be162238b22694fc496d7a946c0e5a085b83257e7e25e8

SHA512
90e08c83dfc95cac80150ebda86085ed2dc86fbc1b2f1112de15638f548e2eb4fc954e3ecc17d828a1a6ed549acde8a1f8ded666865d46ef30eb026127c8b102

Download Submit
C:\Config.Msi\e5bd754.rbf

Filesize
11KB

MD5
2317370717a6bf28b9af805dc45ae5c4

SHA1
ae6876ee8672be7ef18ea64af2293e0d4bf8703a

SHA256
01cd704e1fb542c10b368985c57204b1f78f1d61b07ae6cb193b47aab12cf663

SHA512
5257384b0e7d49852786f81b03d5cbf4026705c1ddf0c533faac970d92cc9e7b9f3a954bde5eefda6c883bbaeb7feda50292245fed9fd1e5914a404d66357ec4

Download Submit
C:\Config.Msi\e5bd755.rbf

Filesize
880B

MD5
f35d405459f10fd3d1f52f6dd64252ca

SHA1
5f3bf4ab1c25ec54e79afe7f92390a624ae5cf14

SHA256
384f7c7d81020a72029972324ec6d8b84dbb3f342418c15e0833db02174416c7

SHA512
2bf358ed9e7c09f49280bffb7e200d93ecd3de99d0a842bdbb468b808383aa16f444ad8888f030d1bad5e00fd49c7c3d01a72a256c96aadcab04dba59fbe0a7e

Download Submit
C:\Config.Msi\e5bd756.rbf

Filesize
11KB

MD5
3e3b6511ef707e9d2344b320407ca1da

SHA1
af55e484ad47daeeaedc5efc0d301ed8d6a7be16

SHA256
8b8be00e22af7c415c0086e48c6ce86ec5d146c75a43829ead4a82d25b5ff636

SHA512
a14250cf607d8d3bde7b9f118bdebcda8deb1b4866042be3aa4d266fcc4734f47f2398c6635d4884d16935c58df6e3a64c68a6196e9892c0c6e2195904cedb30

Download Submit
C:\Config.Msi\e5bd757.rbf

Filesize
880B

MD5
5fe646e5f52a6183027c87160b922e2b

SHA1
53123095d2ff679db51a55961e7efa6f3c2cd09f

SHA256
ff729c37c44b93705b3d7f3e07a35e1debb5deb6be7a00c0a82546d0fb88c0e0

SHA512
a8e7b4f06fd7a2f46d75ba2a43e924aec6d6e270a0ab7b6a3f6cb259d33f7ac78b00ecc6d6b39e8f0433dd35894972790c43d81c7177bfd72decff8a4a768ea7

Download Submit
C:\Config.Msi\e5bd758.rbf

Filesize
11KB

MD5
9473054628d25757f804cc2584a931ac

SHA1
1ec0e971be84d5e980988c16e1dba3b5323e7ca9

SHA256
6c699e95e7a018673fe586f5b96ead5bff5861f22699049d72d92ecb53497a47

SHA512
668ac3365f98ea2c6ba58d13017dd4a2f8ae28dc4bd8e8d72ee6fcfc3a7b51bf0b3f658e8a95c6f5bd2015000f3a347ca417915d99ca4fb7f4a98271a27ad1ae

Download Submit
C:\Config.Msi\e5bd759.rbf

Filesize
13KB

MD5
d80746b2f94a3a28e380735d4b8a9ea3

SHA1
adf85a8d951e2ef30100f88bd072d333839462ad

SHA256
45bdf89c40a35f2bb5e8a49a8fe3b67a9984adb4f65bc40ebf4e320c50194218

SHA512
cfc016d2f98385f407d660e276e31891939792d7de667dc8fe0faff37e38fa7f02b55526084682c75d474757c2dd790b714ac2fe1300f39f54fea61b4b3780d1

Download Submit
C:\Config.Msi\e5bd75a.rbf

Filesize
7.6MB

MD5
5440ee9cd44616d60cde57ebdb286e95

SHA1
bb7635d6911311b2f3a637a2e9d8446fd0698678

SHA256
e3ba35c5572761c20eb59e25b2332a0cdfb726c48963d40291d7f977531e47a3

SHA512
4600215bd9788b30aa5a5038d6749aa294ca0d6d0063335979d2f4acc29af09967a9160bfd8a2ae093f7fcb95c80fd51ce832cb639354360965d0202a044e1a0

Download Submit
C:\Config.Msi\e5bd75b.rbf

Filesize
4KB

MD5
aaa2e20588e154a10747bf1b31b55125

SHA1
03cf9f79b9cacda13aeb644a88180222240b6f0c

SHA256
fd12cbad7d1155b311d97dd5da05869200c50e7698ce997cb96004f18018ad2e

SHA512
29df908a09bfd551c50a3c64074c88814065b5b4cdc0d8a1fda5b1d01cb1f1597f2b71b343b59b9fe99ec7123fe48f9a83f93c0880275c19969523a8bd56dcaa

Download Submit
C:\Config.Msi\e5bd75c.rbf

Filesize
108KB

MD5
7ecb661f50f34a941a44dac7241f7d08

SHA1
772b0df3ad4a89a078cd4ff8e5f45115778d04a2

SHA256
e2386b60a73fa7c95a8968161fb1c84dd9143462b2880133778a3027f75730f2

SHA512
aa007a71da51b145a7fc702a0cd8930d43e03a884c331afb48de01e82e06c20d2a5325aaa893d03a25e5b670e9e0a03f002b55d9620202b6b48045e4a79b577b

Download Submit
C:\Config.Msi\e5bd75d.rbf

Filesize
16KB

MD5
e1eeb7e26ab04075eecc7275239b20b3

SHA1
ba62b37d4233b88948fdc2ffed08f3c82e8627f1

SHA256
d6cdf961c6d2712fe1958815e51a30960d79fff1e97788b7741627dba972e8f7

SHA512
dd64909c983794c8ac6c33b74711a89b3b33e4429bb5a3a2a2b4e38f5d74902b1589a97014a35fbaf97b469fa57a11314c02d68e1db0934de5244308699fc262

Download Submit
C:\Config.Msi\e5bd75e.rbf

Filesize
4KB

MD5
f8d11c60b70acd2ec9154ee676f615ba

SHA1
a869fc75f44438d9207511dc73bae976f558ba6e

SHA256
b342088c8a4403092703bf40062041265e12edd204aff4f6532226478a65cbb2

SHA512
c4c324e22ff7570c6d9a6fcd5ea3bfc4917a404110b3e202be847355c57c189096feb5c37c0a36c541f4a9d9e80bb1f1bc5db3f4146e515ba34468c5547ba907

Download Submit
C:\Config.Msi\e5bd75f.rbf

Filesize
78KB

MD5
5f0934c524364c1e1a77db8ccb832c5e

SHA1
848eec26bf024a7c350bdb02d0e92116a4882b76

SHA256
82589b2d5ecae5ddcda39076a33180b6cddb7f54a0cffd4329087eb1f507bed6

SHA512
1ac672272b16a6bfd3977886fb773a21d8606a873478ff036a462728d18b59e9c68a08606e1f869b7e6606416b74c90c72ff9be33036371282564b0d3723a222

Download Submit
C:\Config.Msi\e5bd760.rbf

Filesize
908B

MD5
0ed609c8782c37c67a5ca7233f08d103

SHA1
c286345aae83608005c0e20aa000acdbfabbdac8

SHA256
10913008d1befd194fc4c96cf0ea20112e9e075974ff5420557141b7ffd5198f

SHA512
92d4547b36cf76823bd9658cc8476afa33f1b20425fae2bd05ea353b6d4de6929c5b72f10100aa1b11493c177df0526aefd1e7d3fabc10d848b88d9f0a382d9c

Download Submit
C:\Config.Msi\e5bd761.rbf

Filesize
11KB

MD5
524014d39a54d3908de59807c09cae3b

SHA1
cc166f76626f94cdbabd8095286a82a474af9f8e

SHA256
f259988c45f54338d57175fcf4fb9f895d484a4eb0c4b861a3abe885c263be66

SHA512
02bdff78beab753a58f46579e61ad4d2953475edb53b57f75ed4828ff04d9641f114357f11059ae28d82c1d28f7433a4eea7b7cc01c1fcf85bb5dc6d58261182

Download Submit
C:\Config.Msi\e5bd762.rbf

Filesize
908B

MD5
d2bc82e2f203cc4778ff312475a1d37a

SHA1
2da7e8f3e8e4189acf5624bead6b7b983af17e5e

SHA256
e34e79770b6a3a4ad1583c9a90ac12aa4348ad134366c0b0436f00162fa41734

SHA512
976b018f717e45136be48ee8b4ba2593f88e5ca3c6d14602621d2a394d13bbbd6e707ee3a611442caadc3f5f1ac1a8de87b0407da8178a74d25404cee3d9657b

Download Submit
C:\Config.Msi\e5bd763.rbf

Filesize
11KB

MD5
c1e58c73d935540d0673dffb303aca5b

SHA1
2a95a12c512a2aaf29587db1ec4271cb92846bed

SHA256
3d004ae76cdc99ece59a0dfb980182a727635459eefb4590d8e2c80ac3115b44

SHA512
471b7f432369940d1854dfe50a71e06df25550704efc4f83c60815bc017dc19f875e2ee3733a9750de4e79c6413db59e762df42777b945d0bc045893604b23c3

Download Submit
C:\Config.Msi\e5bd764.rbf

Filesize
224KB

MD5
fda48714f6a291e25a1a219e89d59d9b

SHA1
c1e8ddfc64995c0acc48623f30aadb1448bca62f

SHA256
be2885e897470da3778a661158dc21f32a4aada769996abda082cc4bb6030086

SHA512
8508ee381bfc5d2491fdd9b14603003264441222984762d14f06440afbc2cc88d80b95bdbbec4089127ec76402408a60b850e1f46ebb5bcda5aa3ef1b6ce70ab

Download Submit
C:\Config.Msi\e5bd765.rbf

Filesize
1.6MB

MD5
574d91266ee9fa03432cf50da30dd232

SHA1
b5c48a695fc376c174a79954a6d49280178eb4ae

SHA256
6f262bba82eed8a8d69fac44e491b99cca2d4cd448166291ce2186833e730a85

SHA512
f052ec088a703e50c893decd7f88c0af2b36251dfc70b08e513d55964d1be299f0d772d52e71bf0aeb9abb752eda156767b8be321320e1c60f78af285b33aeaa

Download Submit
C:\Config.Msi\e5bd766.rbf

Filesize
898B

MD5
846e77a9f3c6bb2ecf5518d470b2b908

SHA1
f16c73c5b7a4b0a596ab41472a246faffd9a9b01

SHA256
17a9b9222850ce3e6786cedd7c698aa145453b37cf8f03d676fbd89f70afa072

SHA512
d94115b82c4abb4570a821919458fb2f322d939928fba6f00fedf139f489f358004de4db3b58b4fce05afcaabf7fcfe9e51c3cb7d0f6f43bebc56c2094086941

Download Submit
C:\Config.Msi\e5bd767.rbf

Filesize
11KB

MD5
224d8b3ed1cc4f5b32e295612f1c263d

SHA1
d84f00249e43dcf21d4e68c1b2b21efed5f3c267

SHA256
20e49d3119901517f055950021e922971cc65578c4ea2898593e29becafd2676

SHA512
87f9a1d17331e85a3df58fcd92e65a60f7b1a74eeac6c6707aea56fe7dde578f1b09798dc3f7a7c0a4b65696524793d7121b19d27902ecfc215a3233128dccd2

Download Submit
C:\Config.Msi\e5bd768.rbf

Filesize
898B

MD5
ec5a78ba8d91e89c0d9b3683d0cfd5d8

SHA1
0db33de0721fda2e302c39b98f3987ddb9267850

SHA256
b3d09766f50b21e4b825d1ec7908cadc7fd74625b4757dc7952344797c72ac07

SHA512
c8ed1321211aa260ad8fa7314cc4036a743c0bc1ac06defc9d061edd4c3032f1e42c6cb06f2fa8836e66a0a4816a921961a5379b0e20ced8fd4f398085b125d9

Download Submit
C:\Config.Msi\e5bd769.rbf

Filesize
11KB

MD5
7273fe5d0ce6473e646ba240e3fffc8e

SHA1
af11a7b48bde2b1046779147c84d3287a469639f

SHA256
d4e738f4e3d39e7001830f71b52836a20707d14269cba22f34f3fdf0436981dd

SHA512
9efc625c42ce99028297b23c78226264c851d74d84158c2221c2ff9faffd37248a3977461e9fc021e25b903bbc11ec475178157bf9fae9512bfe39eb98404a6b

Download Submit
C:\Config.Msi\e5bd76a.rbf

Filesize
898B

MD5
2408534b8cefaf5362700e8afedf070d

SHA1
f197be5f143eae025a5c40837b8432e89b8752a3

SHA256
e89e45dabc6a2422cd5f523d554d6314cf9ecec2238e26c6d8f63f040ed9b6c2

SHA512
94b78d6d0b597fe9b69d438f4ac3d0855ccc9c684a28070bb9e2cc44d171b5047b8c3da03406a05405c74ab56081dffbfe84478064b0b0884bfb6e415c3159fb

Download Submit
C:\Config.Msi\e5bd76b.rbf

Filesize
11KB

MD5
6d525c5be39dd69154fb0cf297fa9c1b

SHA1
48b89a8803b7020d7a0bc5dd760c261b2dbb87bf

SHA256
82a7761c6042176cf97947da1e910ce8a320fa7a17dadee2a115ac5f34cdc744

SHA512
0a0416c8a7f967ea869ffe2fe77535cdfc9211d78fbff89e58cac0a4cbc38ba182fb3e88f4de3d38c010f6222ba52f8f10e3f58b4d13e5c7438f9a81a8f871ef

Download Submit
C:\Config.Msi\e5bd76c.rbf

Filesize
366KB

MD5
d78266c35a0ed4bb6fb2f6683c8a6e68

SHA1
7ebda40cdb602b20323e6e7d24f28f25a931b11f

SHA256
c68b82408df6d0e6f7c7ca0a5e7d1c80af6cbec57788570bea58efff8053f306

SHA512
e60ae6b2cd22614be134d06ce823bc5d31d0aaf1f01dcc4fd0f6021bd307609e8d2f47ebf8490d3bc33f0b225303b63e44f09384bc3804494f595e876e673854

Download Submit
C:\Config.Msi\e5bd76d.rbf

Filesize
146KB

MD5
e8013aaa8fea097b88d7021039154ed9

SHA1
4866c788df4739c011e62f3634989e8959832730

SHA256
a3334e83a418db4f304a621c2a498db48c0f8fe21f21282cc61e5ee9b80c1370

SHA512
8614a03a87b2c06d1d2e577def16deea927e010d0f269f37613b9b737edf72350a5457b22a82d96ffd6d02747bf70116be301f891a0b103214ea3a8263cce32d

Download Submit
C:\Config.Msi\e5bd76e.rbf

Filesize
898B

MD5
4da7266720463186401b1ee9ae625e09

SHA1
040cf60bc1f52402d10e0b898e38b907dd9d9ba0

SHA256
2ec5d00d46355af4cd7d06a00745e726b87c329d090e0acc02f767e75c60601b

SHA512
da22f8e24f5d59232adf9e77914d65a82ec2bb1331a83f72c2d45f8e6e27de3bf113173ba56bcfa40e95851f105bfd941cf63392bd6d4fd4a9b1eba36087c091

Download Submit
C:\Config.Msi\e5bd76f.rbf

Filesize
11KB

MD5
91d3ae6b71705330e73ca4159817ff4e

SHA1
a941037aa373a426e73dfb853526f150ce4457b0

SHA256
4d16c2bc77cc45c596dabbccf24e51b8d6b47c6582d540993856337d9c7dd6ea

SHA512
8866140622e9241bbc2a5f7f26f659b7d2dcae7890c6ad357f76afeb5b96e6b30914b2b223906cd1f2b29eea27e885e33774782cd2c3b688aa1da72ee61a56f5

Download Submit
C:\Config.Msi\e5bd770.rbf

Filesize
898B

MD5
de2943783e864e16eb161a507dedcd3c

SHA1
577774c71730c72d22a80e5d049073fc23f8023a

SHA256
6aa7490ae4134caf546322c9aafdf062082536e1b4c8ed063c8bb5f93cab8afe

SHA512
00abc7a380a864e808e2b0de3dfa5555b0bc691b0d8153bcf24935495b21722be21f9143edc67c7a0fe69f9e3d1e6ebb3fedd633efe439e6b58c1b5594c051ec

Download Submit
C:\Config.Msi\e5bd771.rbf

Filesize
11KB

MD5
da8a2cab1ddbd3fa6cfa43c0bff54348

SHA1
45268d28d4e628781f65f08612394ff7e0d38720

SHA256
a19e7736666470a6eda6d00473cba753deb0e8fb40d3311daf3c50676040e200

SHA512
18be388c509985137e34d4ccac72e60dd726f9c64b76e25988b7c91b3a306f1d15b21546face19ca087db02b0949306a554a889e3832a39c83f5f3686dbb5b10

Download Submit
C:\Config.Msi\e5bd772.rbf

Filesize
898B

MD5
5062f0598bc909a99bd21ff77d3421eb

SHA1
4917cf83d7e3ebac3fbf3e405c4dd633430cb98f

SHA256
e2e634f5552e5214c79cdc2a33672f2cefda7c73fb6d9c7b87916130a969c4b8

SHA512
ed1d812cdf867b963d0a9bebdb6d63698bb107409920ccdb770e197815f5d72b35cc8c1e3602d4b5c63adf06c0d9e125c5a5ad6eff2da22df373b06c7c88be2a

Download Submit
C:\Config.Msi\e5bd773.rbf

Filesize
11KB

MD5
4667b1d3fe384b97a94deb1553af2174

SHA1
e14902922748fffc1f65cb299b52c114887b761c

SHA256
705b42f6a55a4cecd347ba954089148572ba9fa033e5a08dba176b652488457d

SHA512
3f2db08d7fbf8f6042f7ff1001f20df3879402a25e7d3b8bb7270ad3be7216ac07a8ded7cd62568d6292bcf3828286105e1d9b87f21dc3e1764d0bc20985a8bb

Download Submit
C:\Config.Msi\e5bd774.rbf

Filesize
54KB

MD5
4f94bf5157da351f7d0089a0b72b1ad9

SHA1
c61d8fb8801a3362fcb8eb539003c996cd94e9fd

SHA256
257b042bbab38406cb720fb9b2275828b003c6be15933227ceac68e08b846412

SHA512
f75d0365f67ff6632c8d1a3745e8e8eab55b25a562841910320dfda967a5428a5afc469a211e90d7ac78930fd55e0597b11aaf15cec5e57c0f22c02da53881d5

Download Submit
C:\Config.Msi\e5bd775.rbf

Filesize
16KB

MD5
df0c6bb7965a3dfce5f0f158e9d5251f

SHA1
5250b2c7d557a71dc9fb0823fdc0cc94f0a81e35

SHA256
883e42e3319fa4c059623e4d5a937215ad2f2cb123e88aaec27955f258627c4f

SHA512
8b5f7cfb9d3d857b2396706cbcda445b9131abf79e84296ecbbffff0dc1588b19399b506e4e3110ac4782f60ddee081cd5243e598e0871738803512358efee04

Download Submit
C:\Config.Msi\e5bd776.rbf

Filesize
902B

MD5
0da2f7810a668012c630db3fa8230499

SHA1
9ca963ea4e3544609741308d71863bc86a0c0ceb

SHA256
4d997a3892a9fcee4bedb3f47b91f068d6ac823c5ee5f00d1887634e438f41c0

SHA512
57e214fa9ea204094bed5086d6542a32774b3f234edd93d6f9eb364cb7a0825b2056bf2a299c65f8395545fe7f5e21869525575dbfa3c0b35c796f8de6c543ee

Download Submit
C:\Config.Msi\e5bd777.rbf

Filesize
11KB

MD5
15caac1ec79f05d8aa62aaeec6903e8d

SHA1
1990604b5491cc83a73f592d1e70b41be5a2d998

SHA256
e485f4d3468410e989c147c9abeef742c57650a794e0ff18c2902eb976d25cc2

SHA512
d418191828c8fca0a4d092d2101191fa5afdeff417cc4c9f1ba02795e3e4981a3ea3b0478c6abc00e284f95c5529a686411b90870569bfcbca15fba61372d402

Download Submit
C:\Config.Msi\e5bd778.rbf

Filesize
390KB

MD5
2cf01239384af6de8b712278d7598e90

SHA1
613cb264d8628008809878154f6eb17f35031c04

SHA256
51a234186dd5e1087a7ecb79bb8538767bd4bf46c645e1a6e83f972de726e95e

SHA512
0e2dc0cf2d2925895af2e5fb918f0c171bcabc6dfb8c094dd63ff7df535f776ff2c3ab89038ca5bbff0f4c02d8474055adfe3609c70d97870c46504f7bb871e6

Download Submit
C:\Config.Msi\e5bd779.rbf

Filesize
908B

MD5
a9762e02d260a34b79fdea198f3e82d6

SHA1
5023fc4a74ce1eb15893cf0f724e658c9c5236eb

SHA256
15cb74f02499b76c42faf72e6364392bfa997d0b2668016bec69dbd7d0571578

SHA512
61aba378b6a2533b9f67b4f46a2873fb08be4fe55c0de18785cd1720f4041aaf003ab0310a1d7415d8153508789ceaa82fd1b0731827f75aab41c5962c905502

Download Submit
C:\Config.Msi\e5bd77a.rbf

Filesize
11KB

MD5
af6ae18e360ffca6c0ceaeeebbf6d8d4

SHA1
0b4ee1121e9070e95147f6c1664f23a9c772ac7a

SHA256
9ae57781418fef37b51dcbeabd4e26dd82a35c3aa2c15917cb98656889d3c7f3

SHA512
eee57abce64bd9b1514a5a3a074948547725e78aba19e085b53d9e8156613a1ee30e60fef77429844ec4abd22ef02c45fe9f31aebff0eb7925e0a62e2b4efad0

Download Submit
C:\Config.Msi\e5bd77b.rbf

Filesize
908B

MD5
97cf058f86fa06f7e5893211dca28a42

SHA1
17bc3e8fdc48c24ca60d7b1ca10acdbfbd8b5e9f

SHA256
742530e55d505236eae91ac26a923b2efa8b454fc0b449ba43f1d6a28ac5b52e

SHA512
84df980720e846a8a3651d62f2639108818d18db139c6e0b41acb0ef4642312e11689bb6971ef778c1638d8d53430571eb8d560061e6e8c0cc13c1f40b35fcbb

Download Submit
C:\Config.Msi\e5bd77c.rbf

Filesize
11KB

MD5
6a5ee23e3d7b67dfc39ce1c085d8c654

SHA1
6f9c0d88df3df2cf86cc543822b2e6196e849b15

SHA256
b40f265fe31c5dec0943b2d910e997ca1840ee290912b814eeab333af71fbd48

SHA512
2d0cb3ada34426ec079933c96af4e3e67795cba52a6a78b520b7c7aa02a7e0eff53a33da206c7843df42a257474380b3014338c2063dc8848edbacbc6cadbbc9

Download Submit
C:\Config.Msi\e5bd77d.rbf

Filesize
908B

MD5
9184814c35561939e4b0ad91788441f1

SHA1
a5281447d62fb3acb7915e757c68b6c29ae69adb

SHA256
788f42981bf0bf25f0899d9e3c19a0d6edea44f9c1f9eb616160de99b82e8d27

SHA512
cdd744fa29b63922cb112d645badfe59176bed7a5c2ec12e3e8d095ca2401588565f356aea4a1f40157434fd8d20edbcfc92febc4fc33e4a13a20abcd38ed199

Download Submit
C:\Config.Msi\e5bd77e.rbf

Filesize
11KB

MD5
acfd9dff068c374658366e397a5695d4

SHA1
bbd33c62b022d3592e0c2a67144070ff4e2709a8

SHA256
a4d8b8a525271bfa836744b7705f0993ab454d9a153f81b3502cc62d9284dbfc

SHA512
b2ca941ee0d18bec576ba84e09403cd8dce41b9017134581f1a2e2babe25dff99e9f172a6e9764ca6c58d5ac679405883640e2b7bd108cc0308336098d9099ae

Download Submit
C:\Config.Msi\e5bd77f.rbf

Filesize
19KB

MD5
f8354171db5fc4506cd0a0b9a3c9eaf6

SHA1
f155f11010d91896161a2818815a1dc32f183731

SHA256
6131d4341986952f7343eeb984544a17bb5f121e1b24ad572ae93d928f9179fe

SHA512
10aa970372b956ee7d018b4d5d8bd7faedaef20b83ada551e7a260730d5a642c9ea13548743ebd470f5ecbc7a08ddead828c41e229c96538d93d3f0ea7cea52b

Download Submit
C:\Config.Msi\e5bd780.rbf

Filesize
904B

MD5
967be7e7a5e3cfc4902a4dcd26eda18a

SHA1
f0b364113ccd380a256a3f6217b8795300d0fe30

SHA256
071549c2a67ba11cb90362c3a60b904e339c66d33add4e0fdaf348f17365695a

SHA512
db437ef46aae9b0f45bd21958397c163f2c55c85bda25215af041023c63531ae3e0b62fec62ba76b70c6a297b928fb7c8a79ce82463ade93d22a6501b756ccda

Download Submit
C:\Config.Msi\e5bd781.rbf

Filesize
11KB

MD5
e9e2502356902589e8b0b86314294f30

SHA1
44a972c0ccbd52ac6e21f2c0cc1dc81907b5e7dd

SHA256
c1fb9faa66ac74fd4094538d83afa96c8c3a5bf7f30ec302b7ed1ad1f4d99b25

SHA512
7e51bd97735028dd90e855d8e661e2aa8c9e859e2b4c02475d65ba67eab8cd99ce207795e9a6eb4b146483852bd90255feaabc7b50534a7efc43bbfdfdcc2849

Download Submit
C:\Config.Msi\e5bd782.rbf

Filesize
904B

MD5
8a138a7c5f6826e2adec47162589bdc7

SHA1
8ba9043cc728827655406126e46950e6a6bf35a1

SHA256
9d4041b781a2fe7e677cbbb210497abce1c6e566047fe4592d6b2bd182768c43

SHA512
beb99a0c999a2e2b3bee93c32246826608d74c95b4aa1e5993228dc5af9e1a775035f52bacbd488d7589f9821fe17df2652f94bc5b66297963fc3f6062b8e0fe

Download Submit
C:\Config.Msi\e5bd783.rbf

Filesize
11KB

MD5
aef35350473c3e263b6d8d4a76616b7d

SHA1
265bf8cadf460109a3a2d0d8e23b7b1eb18d7660

SHA256
fe61442089ed613075613d0db818e9f1c87907dd5c76dbfa67e93abf7f24e135

SHA512
b4f966b9c921364283a6dc42d8b44ec10e8d032089dc157c23ecfda55fbb16f86b9c02cbb22fa0eee51dc784ed83876c9b29ee9cb1cbe823e3b99bf08e46cd76

Download Submit
C:\Config.Msi\e5bd784.rbf

Filesize
904B

MD5
a5c7d3197e0ac097600d2901ed4f6e77

SHA1
a459c50978c7e377f1130d7779f4a2fa41d0033c

SHA256
8d0b449684a977a3d81b8fad0663a20555504e8609c987e84364a6e232b51356

SHA512
f9d662be82e96ff035c7aa938a9de7f47162bd4564575eed4aaa42ed4ef49ced0fa4a9b6b2b789b5655c3ac6787f7b3c8439d82962d9668c1d31e62a54a804bc

Download Submit
C:\Config.Msi\e5bd785.rbf

Filesize
11KB

MD5
8b1132f4e0387a233497141cf30b1edf

SHA1
2afb866bc5093b1281b2ad0fc4a29bc2cab035d5

SHA256
51063c0b520a9ab73aa3a0674c593c3c3de26fa9709175be085d2d8c456ab54f

SHA512
f528da8cd45823fadecf870a348f605e8fa199c6bb139c7930392cf638289c794ea15746cb0f4b9d918a1fcfae7c6578261e7c20fced854e9afa20974e252490

Download Submit
C:\Config.Msi\e5bd786.rbf

Filesize
918KB

MD5
be6f4fd7365dfa124d60114095380602

SHA1
66a41958ead9151d7e61d690f12006ca8a40df89

SHA256
66d6f247e3cae875c3c86dd16ea1aa3512663b8aa8626984007bf5343326bbaa

SHA512
e9f7d819714c905577a2603aa30cc72b87b7a66561c7cc6029dedf48de78fc3db580069602dedbc6b18496217da6b94bbe0c2734ba2dfa5f8b57b7fc6cbdb781

Download Submit
C:\Config.Msi\e5bd787.rbf

Filesize
896B

MD5
070f18d93af687edf010efa343dcc983

SHA1
16858f9fd0d8ed788ec49460ca2b596c193d2af1

SHA256
89547b37ec7e20f96e1f1b9aeabbe86cac8a0372bf1520fbc2272eed16f8b4a0

SHA512
e7b9ca446b5ebf397e7c220e8a0f639ce20fb35a11010b641f6727ec1c9119093790d4f5521ebb28e8f6de4ed5c4c4f58a27355fb5d012ec949f0de3df5586de

Download Submit
C:\Config.Msi\e5bd788.rbf

Filesize
11KB

MD5
a06591a7b689e5fe00f6755a180af130

SHA1
a581485fe2c6d9acf795e80c7d6b0f3a0e721584

SHA256
6555b4dd2c4e4164c8e00c06f6108a9c1dcdf141a5ca54bbe5675e08750f63b4

SHA512
bc0195276fa8c7937c7c39d567a7f41cc4ef92521836515c11ef5b422d68aa791b96fed829900e998435eb5b719c3a21e58c94534ec1fe4d637e39d43407e4ff

Download Submit
C:\Config.Msi\e5bd789.rbf

Filesize
896B

MD5
9f8ecff52bd15cff2deeb91bd325e101

SHA1
c82a0eddc66f95f0bfe1fc984671837cf0b07a65

SHA256
aca44b663633d4785d4fca1ed45d2c1d58c994fd927374569b8b5bfcd7079170

SHA512
cf52103d480a589e88c909239dacf5add2467adf6f4ad52d89af16ffb9a5cb32d7e771fe005694d37189ab2ecac08cad9ca7cbcc7d971f17d384a959705f168c

Download Submit
C:\Config.Msi\e5bd78a.rbf

Filesize
11KB

MD5
90891a2ac9ef19d26ddfae3dcb69fadc

SHA1
14af0ba5b5b4ed5dd82685c7e50a544a5c5e7a98

SHA256
dde3ccb81cfcc3eb4cc65752fe14bf0c7ffc6814d55f7c9bca4d9ae638b30f6d

SHA512
4f97ab143a719bd614a63a3b34bb6ab6931eedf310e2e077c361fd63d2d579e126a3a419256834b021d86250114ecf4c0ef120c9fb267be9aea004b252c17a49

Download Submit
C:\Config.Msi\e5bd78b.rbf

Filesize
896B

MD5
f1e8d3b056eb17b33d6d23b5dd20eb56

SHA1
7556e1bf214dca70ffec24768f3c549ab4ab1886

SHA256
e709b2b5901d6987b46febd4f3d5ba50b94e4ae4e0a6bde09ec981509b72000c

SHA512
914b340a8c175dfed4cdb99bf071e14ab787481517009ad92680725368dd7b7667dfe2ffcfbaa871b2a9edad6b8566828133dccbd0a0c7fb90cbabe4f812da87

Download Submit
C:\Config.Msi\e5bd78c.rbf

Filesize
11KB

MD5
3fd311d5a5cab694d93c6de5ab39adc6

SHA1
2950e2cecaa45f46dcc443037c7a4db550533578

SHA256
4e5cd2074b70b073ff9010a22f6e469fc08c93f63e14c85de93377c2d0e97fe3

SHA512
fd884db714d134994c1ef742ee85d5002b07e29b8bf1db2120a4139198f162ad67b093be3f232eeff3e05976ad243ef691af69db86ebcc8e2d6f0400245c6a35

Download Submit
C:\Config.Msi\e5bd78d.rbf

Filesize
44KB

MD5
bc959a160882b0de0583047b1b5b93a6

SHA1
78bda837a0fcc25623b54e95f3eff76c3bd79332

SHA256
b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e

SHA512
7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd

Download Submit
C:\Config.Msi\e5bd78e.rbf

Filesize
41KB

MD5
91ceea551937cb5da627f33ef7995ee8

SHA1
4e7483605c4027381e4796345f0a0e6aa9342a5b

SHA256
4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806

SHA512
2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9

Download Submit
C:\Config.Msi\e5bd78f.rbf

Filesize
76KB

MD5
7173d17aa9ff4cda07fbfff21a584a67

SHA1
37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc

SHA256
972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867

SHA512
b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167

Download Submit
C:\Config.Msi\e5bd790.rbf

Filesize
35KB

MD5
da7787ae5278031ef79441d29599dcff

SHA1
4e2a4c70035808dd8bffaeb6ded8fe2980566e0f

SHA256
06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39

SHA512
2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e

Download Submit
C:\Config.Msi\e5bd791.rbf

Filesize
35KB

MD5
86a1d818b679edbe94ab51b963ba79a1

SHA1
2b9ee6b54aa2f709442e7e514335e2548c933318

SHA256
b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa

SHA512
ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9

Download Submit
C:\Config.Msi\e5bd792.rbf

Filesize
21KB

MD5
6083b2909a6c1ab52ce84da1b435e7cf

SHA1
e851ccddf1fcb0c2fd9cfb4a357f72633452f240

SHA256
0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956

SHA512
53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1

Download Submit
C:\Config.Msi\e5bd793.rbf

Filesize
24KB

MD5
d87310699e3baac5ecc0f64673fe3485

SHA1
34460b0eb74977b98d9d3e683d5ffa2aec11059c

SHA256
4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb

SHA512
096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38

Download Submit
C:\Config.Msi\e5bd794.rbf

Filesize
280KB

MD5
a3ae8e892e025e479978fb07fb449784

SHA1
71a1641ffb0da859af5e355c5bf4a9bcf1746e74

SHA256
a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b

SHA512
e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54

Download Submit
C:\Config.Msi\e5bd795.rbf

Filesize
108KB

MD5
1c8e5ef9f86430fbda800e45c0a89aa5

SHA1
4e18ee249a208dbf7d7b52d412fa0d402fd3ff2a

SHA256
6e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6

SHA512
721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66

Download Submit
C:\Config.Msi\e5bd796.rbf

Filesize
152KB

MD5
6742f826c21773c933fc2a68ceecb99b

SHA1
dc689d3fb31e7cab6a33cd2192d6114542173514

SHA256
a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036

SHA512
4138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a

Download Submit
C:\Config.Msi\e5bd797.rbf

Filesize
140KB

MD5
cad14a2ced4a556139097c1f716eae70

SHA1
9552115b645c17165bacc2231725b3f8073105a3

SHA256
35cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a

SHA512
df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331

Download Submit
C:\Config.Msi\e5bd798.rbf

Filesize
189KB

MD5
1f50737bb92b1f71b15824a0f113d3f9

SHA1
4d78793ea921986d011a024b91ac59d6c02de6e0

SHA256
f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57

SHA512
89e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4

Download Submit
C:\Config.Msi\e5bd799.rbf

Filesize
76KB

MD5
d68368708be2b6dac797743e23dbf655

SHA1
e843b858d72359ecf6fcdfca328ed19a7f23210b

SHA256
dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361

SHA512
2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e

Download Submit
C:\Config.Msi\e5bd79a.rbf

Filesize
428KB

MD5
9e877ffed2e2c9a013c59581f88786b5

SHA1
d3bbb3e2c36520ec267463916d3356bf4fcd8037

SHA256
13f36534cf603cd722ac9078e51930cba190395d23d6688b65a8c788262759e5

SHA512
5b4ff6de141bf2dc321dfa05fe8c93f64ca91eae6b41041264736c3c6db9d0520c135103873c5f32a47c742fb51317b3303e7656cd259331113f9b876ad17613

Download Submit
C:\Config.Msi\e5bd79b.rbf

Filesize
292KB

MD5
bc9a83d77cae33f9eb9bd538ab65b2a1

SHA1
363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8

SHA256
d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c

SHA512
37ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57

Download Submit
C:\Config.Msi\e5bd79c.rbf

Filesize
128KB

MD5
c7fc5f01de9577403a1ea8aafad79e72

SHA1
6422fa355184394ace02c0ba88e5b8af3db7fa6c

SHA256
c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef

SHA512
b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87

Download Submit
C:\Config.Msi\e5bd79d.rbf

Filesize
92KB

MD5
535d9d8441e0e22aa3f407c7197f8a0f

SHA1
ec6d047e975c107a7ecdf78bf352a5a68f53392f

SHA256
6e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5

SHA512
f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e

Download Submit
C:\Config.Msi\e5bd79e.rbf

Filesize
356KB

MD5
5e1a793d9615d4d9e153ee416abc83ad

SHA1
27d231f4d1e2b473f9695daa21b22804db779826

SHA256
8186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090

SHA512
f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876

Download Submit
C:\Config.Msi\e5bd79f.rbf

Filesize
352KB

MD5
03898441f5d9a8809c04fe746fd498b3

SHA1
35cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6

SHA256
8da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296

SHA512
dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12

Download Submit
C:\Config.Msi\e5bd7a0.rbf

Filesize
82KB

MD5
f148286b321ed09c2d17e9e3637c807b

SHA1
b0928429f52028b512dad9c7e0996ee7ade315d3

SHA256
33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a

SHA512
d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b

Download Submit
C:\Config.Msi\e5bd7a1.rbf

Filesize
41KB

MD5
e3c8239a97601bb203b9e9037eed89c2

SHA1
75f0e5f417477d4c491e8ad81f498faf761618a1

SHA256
27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db

SHA512
71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2

Download Submit
C:\Config.Msi\e5bd7a2.rbf

Filesize
76KB

MD5
219c69df0c23fdaf84e4c9ea2835a628

SHA1
d3b091bfcaa8506d299cb1d7453fdce7fb27dafe

SHA256
e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457

SHA512
e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8

Download Submit
C:\Config.Msi\e5bd7a3.rbf

Filesize
80KB

MD5
75e8bc00ad7da1e7628f146dc33cc83a

SHA1
b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e

SHA256
5a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d

SHA512
b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3

Download Submit
C:\Config.Msi\e5bd7a4.rbf

Filesize
48KB

MD5
775dac5f81248b14182c82013672c42e

SHA1
cef7bba712b25da04f60f597cb614c7e4b87f24e

SHA256
e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f

SHA512
2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c

Download Submit
C:\Config.Msi\e5bd7a5.rbf

Filesize
24KB

MD5
2a9b706d83be29f32a28f29be397e533

SHA1
31135de80dd7b7c4a27516806fbbb13d871548d9

SHA256
db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236

SHA512
cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64

Download Submit
C:\Config.Msi\e5bd7a6.rbf

Filesize
36KB

MD5
bd3e2c28c647533a057b5cdf8bff2c5f

SHA1
d36c80e460c5dde615ab1c268bd89309225ecb82

SHA256
f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b

SHA512
14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc

Download Submit
C:\Config.Msi\e5bd7a7.rbf

Filesize
52KB

MD5
63a1e9cde10490008ba7ef47a12179d1

SHA1
5299af182b7cf08f95fcb3815149d7c54e73187d

SHA256
9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4

SHA512
dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe

Download Submit
C:\Config.Msi\e5bd7a8.rbf

Filesize
36KB

MD5
7a016cec8851a57b2f0376ae6d1fc837

SHA1
f161f9d8d7b073c1f17f55719c37124969bd7d2a

SHA256
19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b

SHA512
f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456

Download Submit
C:\Config.Msi\e5bd7a9.rbf

Filesize
64KB

MD5
4d4774a30da56119888490cdf3157b09

SHA1
360221725daa9b7a14460fe6939d54b2173fb8d1

SHA256
0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7

SHA512
eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130

Download Submit
C:\Config.Msi\e5bd7aa.rbf

Filesize
62KB

MD5
9002a577c07ab2b99979435cd8b67acd

SHA1
5b3c6231c113b726ddd55fd8a8e3ae84b1526820

SHA256
c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1

SHA512
f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47

Download Submit
C:\Config.Msi\e5bd7ab.rbf

Filesize
61KB

MD5
218e31b07c6e07633a84f0248730e220

SHA1
47ee36529b741f3d52c487e6dad151f516c2eb5a

SHA256
241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec

SHA512
e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0

Download Submit
C:\Config.Msi\e5bd7ac.rbf

Filesize
81KB

MD5
93030b5af327ece3ddc3518410e1af59

SHA1
4be27729a906169d2afcf025e10f308fce35056c

SHA256
ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650

SHA512
247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d

Download Submit
C:\Config.Msi\e5bd7ad.rbf

Filesize
200KB

MD5
c30dfa5fbf9f2e6d18ceb7108923fdfc

SHA1
523c4b9043cd6d722c01215f64173b9287623d76

SHA256
ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8

SHA512
075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2

Download Submit
C:\Config.Msi\e5bd7ae.rbf

Filesize
197KB

MD5
fca2f9f00de26d0b5af4881836d6337a

SHA1
b11dcad7c00c2c85354b131c796ae34bbbefdb38

SHA256
19e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501

SHA512
7fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738

Download Submit
C:\Config.Msi\e5bd7af.rbf

Filesize
27KB

MD5
aa8ef0154efa83de1c2786ab1cb76f37

SHA1
5e4fcdf55c34538dfdda172a985731019f74898f

SHA256
db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57

SHA512
17d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd

Download Submit
C:\Config.Msi\e5bd7b0.rbf

Filesize
15KB

MD5
62faa6fe395c5810fe4fceffcba62966

SHA1
ed830d3d1156c3a5ea6502148f4347af0c4a8051

SHA256
1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099

SHA512
4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54

Download Submit
C:\Config.Msi\e5bd7b1.rbf

Filesize
90KB

MD5
facce237d5cc5e89d8e92a36289f588b

SHA1
5b91fe97781b107df2754a5d38807a597f1d99a2

SHA256
ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9

SHA512
f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0

Download Submit
C:\Config.Msi\e5bd7b2.rbf

Filesize
168KB

MD5
d2d2a9e08ad2df5d73ca0aa0797cd96a

SHA1
f6050bc38d27c805daa078383506b93c5dd854c7

SHA256
1246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879

SHA512
197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de

Download Submit
C:\Config.Msi\e5bd7b3.rbf

Filesize
55KB

MD5
158f96bd130a9f3a1f7e91dc611e8b7d

SHA1
207264f61e8d8cd77c7dd82e7c8c38927bcdef85

SHA256
89885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55

SHA512
6ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a

Download Submit
C:\Config.Msi\e5bd7b4.rbf

Filesize
139KB

MD5
32f2ac5f45b93b733cab1865affd588d

SHA1
5062e6d2a8c1e06e19c9f0b29164915286ece618

SHA256
38f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5

SHA512
8384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1

Download Submit
C:\Config.Msi\e5bd7b5.rbf

Filesize
351KB

MD5
18a9dd94b5112ea94f3fc9fc22ff8409

SHA1
97a0b82343ef1599e517946a2c3c259b61e53ca7

SHA256
55758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e

SHA512
7bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6

Download Submit
C:\Config.Msi\e5bd7b6.rbf

Filesize
456KB

MD5
54c12705dc6a32282762bbc4252e2b9b

SHA1
2d1fd38b5f3db7c7f0d7baee446a00099a506d50

SHA256
a5a600ca8a60a0af629047ef8b227feba5221c5697f820da69e274f40869a6cc

SHA512
c4d96a8d8064ef917ddb98532360a8bf318535b310f908a384c0ca140ed058f5f3f24f34c3992da4399386f546381cbb1eef5432b3ff2b7c19e0491dec8d4aaf

Download Submit
C:\Config.Msi\e5bd7b7.rbf

Filesize
137KB

MD5
9f735917c0bba0f42b40e719047eefd5

SHA1
d8c1ef036b9d841db86ffc76d9150064ee836cce

SHA256
7acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83

SHA512
65522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e

Download Submit
C:\Config.Msi\e5bd7b8.rbf

Filesize
334KB

MD5
4b15c6de8b0cbeb6d4d7d6e14b9ca7fa

SHA1
af3b589712be828302778a6e248ebd659fcdabfe

SHA256
7150db5b3af392a250b79f1078c87848a08b6c13448943d5a0478c2d37645b85

SHA512
1f68f55cb4c32d0abf929b3382d9b773369f376853912829299c6386648c39807c6242eba037bb3988ebecd0e8b7197c91583243154c569bef1f70d0d958c491

Download Submit
C:\Config.Msi\e5bd7b9.rbf

Filesize
75KB

MD5
683fc126a13b915b3ff36735ea5ca5fc

SHA1
d1ccfdf78919f51b09fbde02c2cf0f332601bd74

SHA256
b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929

SHA512
4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9

Download Submit
C:\Config.Msi\e5bd7ba.rbf

Filesize
389KB

MD5
1a063e60707636e76e61ad9784bb1eea

SHA1
baf498bac402a29b1330fcd20cfbacbc5d245cf7

SHA256
878566ee8a41806ee9b9c4cf590e1953881dde2127616a647fa31940a5096cc5

SHA512
39e2bcd04f4ee4e6280b7723a628acfbceef254fbea62833a34d7f4cba566c9556bfcfe2424ada027112a8b722da8349331ca416d00d0e3d6afbec96e3d91a65

Download Submit
C:\Config.Msi\e5bd7bb.rbf

Filesize
131KB

MD5
d8a76dfe6188e600bd7a8480dcedcbdb

SHA1
40080e226be118c2a0a8f9dd70879467ec09f198

SHA256
a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a

SHA512
9a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76

Download Submit
C:\Config.Msi\e5bd7bd.rbs

Filesize
7KB

MD5
cf0b12ece816b3048ad800f68f056939

SHA1
84a30b9e41aa6ec438e2be7bee0df27d08b7ab40

SHA256
94d4afaa846a9e7941a533faf54650bd748c981e9c844982396dbdd33db4d074

SHA512
388bbf9a808690e3fe9ffc73e187d22baeab1d890d1b0f2f66742644e79d7f2008457487968c2a9646cb5a5151df9495d4425e5003e8fbb67a45493027231f0d

Download Submit
C:\Config.Msi\e5bd7c0.rbs

Filesize
31KB

MD5
52b365f8951e2c9fc55fa6e74e44ef35

SHA1
37f0358d9dc9bf18e3aa87df19b6a42f17fc6a63

SHA256
3315aae198f3d71a59457e3437f86a3381dd95c6bb1f7bbae45c128c12c0ed7a

SHA512
82226b5cc35628e9cf8f4c674004b56129f0fb4d451a88684417d511a8036a56c4bd15959564d900097cdbd2667192fc9ffee12ca549da305eb3889fdf05a4df

Download Submit
C:\Config.Msi\e5bd7d4.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Config.Msi\e5bd7d6.rbs

Filesize
455KB

MD5
b27595b3927cdcc91faa6576d34342a4

SHA1
9865bf76e6be57bbbad9c98aba1a3bc9475f9327

SHA256
40ffe3795687fd3f865b8eda7835b85068530605fe4a73a1158db3d3119bb719

SHA512
abac5ce9e58cf156d675132e194a69a50e71f16cfc9bbeca2c8ff9171aef8f5e0b22966729c10134ecc5bbf6f1d6939c0414995d0d856263d44911532bdf4d4d

Download Submit
C:\Config.Msi\e5bdd8a.rbs

Filesize
1.6MB

MD5
e6118e77eaa10e8090bd126d90e45cbb

SHA1
4c97100e94451f3f83cbcaf216966d07949681c7

SHA256
6aea53244d67ecc1512391c1dbe63dd2643df024c45cdbdbd2eb1252473a0603

SHA512
3df4e606fe22166cfbaa5c4b3cad000c0dd13ca8d035db0b70c7ab4ec14688b2062f846c875671a718678750b1390869b7eb3257fc2eb48336ece01a6be7f62a

Download Submit
C:\Config.Msi\e5bdd8b.rbf

Filesize
2KB

MD5
f66d706bcc13e511622b73055ffc8be1

SHA1
e3fd34531245500e793697164499b7c38edb5c8f

SHA256
2fd209c23f01e5066ff73acfe6c4a92b463747462c1a6c82752a7cb3dafbae93

SHA512
10963a7883cc4bb05f34e05e9df63db6efce8b21b51d9c6e23df3c238f0a99bcccdec91bc0c9c15e122d29fd1e86b28e22ba3d5eeba1fd74055362572ac49658

Download Submit
C:\Config.Msi\e5bdd8c.rbf

Filesize
2KB

MD5
d618a4aaa98ae1b597136109d8ed51e4

SHA1
68540e6172cebffeeee377f6f050fc24936604b0

SHA256
ecbc306f5c2beafbf05f9ea1ed4022c7ff61cba71d393a31ea474f7e5e716585

SHA512
729eaba0e86167675990755e8298c4fa863a2de2de20ab28e19ff4309ce524cc38ea4d7e75724062eba307364933baabf3cadce4a79745852569a0f69430a758

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
257KB

MD5
17dc54ade85613728a43f2d733527c5e

SHA1
6420a7744edb234f8cf989b7f261265baa381e94

SHA256
8c47f981e1a46a42a268f53ef1b1476555a54bed7077f7b13b1e562c4c9c049e

SHA512
632541e69c61398c3eb07ea7b8e7a21a6a765b592939f091bf8319cacbf7f294860e5f80c82e8e7ab29e2a20e67dd4d1e34171b2c5858d30ce9b9bcbe167ee43

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl

Filesize
816B

MD5
05ea4d7d3fcfc5ed4b76b0c3e1c7cda0

SHA1
bb2dafd5cf78979a83e31cfe85055104dff5e01a

SHA256
2a2c3bfac69ed00267b3bf1f78752b0207a11fb721634ef209b387dc01495cbc

SHA512
a5c159ff09f5f2f426eff2981802ad860c918cae21630f9b946391e5baf9e8ec8c806e5dca85f41ebf7d8a36cb405803903f8222f88893d5f2556dfaf37f72c5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Documentación de Referencia.url

Filesize
195B

MD5
a5422debbdc81da65f5fa2b17da9eeaa

SHA1
e9c01053c6c45589462db2e31bfd7c6ffea60f31

SHA256
239a4ee2824fa17a17e0b84f94a07fc4bc56edf3f9cc426daf3878d16e722e95

SHA512
f49d75c09140e6b5ec1a2c64ea102396d57edb0c2312a1ab27cb3d0919726965ba3ed34a992898661f974a0405db57a1e5f8948345bebd72e52c07a796ba093f

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
672B

MD5
4cd4c43a0c4f87486d9f52da54bde2ad

SHA1
f95b9a8b8800757f4ed8067f1a1377a406e21dc1

SHA256
3a6284f63ea7d1ba8ed066246ed17372c90d39d1eacc61da966f987fac2dff0b

SHA512
2910707dba1777268a87e438acf218adbfdfb69d67e678aa608adfab9761e70c1fd70ee1877922b7f558dd2c0a9c63b890ebaea11a882550996723d8bafaa07c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
71KB

MD5
9705ce2da1a489a04269e0a48a862f3a

SHA1
f423fcab1682765fafbece5be57c5f08ed3e2047

SHA256
fee1bcde1ba51d07541a872903ddf08d22ad9e64ab8cd3fd12fd17bac7a4181b

SHA512
db4a8f901380a9136ee1112a546bd655135308abfa746dc219c046fa749b1f47fcd9c4ece107f6773fc203e5c8cb6bfe6464540bdf144c61b492a39370927377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Uninstall-PerMachine-2023-3-16.2234.800.1.aodl

Filesize
256B

MD5
c96bb640b971fa6c1791e5af4865191c

SHA1
ad37e777619c03d1b758d652a926763eebf1cf71

SHA256
56d067903e67291ad914b7df6404cf7ec45cfd8c468e75e6b996f0b5e2a0cc18

SHA512
3aa1cb52d09944338e68615a38297015b545d3f0a3e142cf901b0dcc860cdecb81acf17e0b9465dd93aed448fe518c78fe9d260698673c1e4b3b2083807c8981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\1601268389\3877292338.pri

Filesize
162KB

MD5
0d02b03a068d671348931cc20c048422

SHA1
67b6deacf1303acfcbab0b158157fdc03a02c8d5

SHA256
44f4263d65889ea8f0db3c6e31a956a4664e9200aba2612c9be7016feeb323c0

SHA512
805e7b4fafed39dec5ecc2ede0c65b6e103e6757e0bd43ecdce7c00932f59e3e7a68d2ea0818244dfeb691b022c1ccca590a3f4239f99e1cd8a29ba66daed358

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PRICache\4183903823\810424605.pri

Filesize
2KB

MD5
a2942665b12ed000cd2ac95adef8e0cc

SHA1
ac194f8d30f659131d1c73af8d44e81eccab7fde

SHA256
bdc5de6c42c523a333c26160d212c62385b03f5ebdae5aa8c5d025ff3f8aa374

SHA512
4e5ba962ba97656974c390b45302d60f4c82d604feb6199d44e80497a40d0b0a9fd119ca17ac184809ca0821ab6813292892c433ed7277f65c275f37a96070b9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\activity-stream.discovery_stream.json.tmp

Filesize
150KB

MD5
6a0003252c1eee77c554ffda47c3607d

SHA1
498ba8a55c2c4e3b555723527a4298e8479451cb

SHA256
ddb97927edcc8152b8e1d549899c39c7a79842eaa2c7a4d9a71eda228a56598b

SHA512
02bbfad6ae0da0400dcbf53e2f62536e52d2605c1c36ec0642af3ea1da7bcca080b6680cd89c920f83c3e734d33a31bf9efa7bc2642a5701276df609385604a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\oqpbz544.default-release\cache2\doomed\7362

Filesize
9KB

MD5
521d8e6432bacb9f445e2ce9891c1bfd

SHA1
77e8d56a11d31de0e0c99ca81f2cdc1f9e939650

SHA256
fda0045ded97f7bcc19041c59595582f942e7c453d550a79c212cd6879a1fc02

SHA512
225d337e7a4cf14169039e8e32f75f550b50cf999bb04e36d4d937bb9052daba8f6f20a6028b495c5d394dda7ed431b7e1147444edc938bd8d1a2e5eb4d1ab52

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5JRSFV0T\main.min[1].css

Filesize
400KB

MD5
a69dc2ea6d83993a679568d4c10de069

SHA1
c7b53a9d5f9754135c1a7b37fbcf18c703a16da8

SHA256
2056fab02a3c538a99e52970932759e94e0438a5787d8bec7e9f2a7e07b84a9e

SHA512
af8378f3801e3943f3bdcdbeb7453a290b7030773f7d6c7bb926dea7b4d63028596fc4ad93786c3c481f5220e6c3ce2c87be375c4cb86caa91a978d5056ea801

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\C0YEUXWT\analytics[1].js

Filesize
49KB

MD5
54e51056211dda674100cc5b323a58ad

SHA1
26dc5034cb6c7f3bbe061edd37c7fc6006cb835b

SHA256
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

SHA512
e305d190287c28ca0cc2e45b909a304194175bb08351ad3f22825b1d632b1a217fb4b90dfd395637932307a8e0cc01da2f47831fa4eda91a18e49efe6685b74b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\C0YEUXWT\cb=gapi[2].js

Filesize
70KB

MD5
431b7a033ba322bf1afadfdc418ef51c

SHA1
6db38f92af6b835676a4237542ab04393ae7da53

SHA256
61f03fa9aac1bad9b608aece66f9698c332d5fdc7c597471f84cdece85ab89d1

SHA512
e81cae25ac7cc74e162a612cff97d1af7a7dfff34e074234725dd88d45af4e6effb82eb6b7570ac56add120dfbf249cf26230bdad9db87a99e73b87699e3bc54

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\FYNM7RT7\googleapis.proxy[1].js

Filesize
17KB

MD5
72917f5c2e4567898a632cf505bacebd

SHA1
e73b0be3f78074be270068086a98a134792bdab2

SHA256
39613ede105ae41d870d8cef547ebeab91b3c8fdfd26b8d8505aab1c94752869

SHA512
009b990e321b7fa6be29bbd56c62e9b8aa3e0bee38b967afc7be14b7604d56dd991b1f87b1bdb5e64585ac40b14688a7dcdbf367105f5a9c01ee6358090652ac

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\A7GMVLMS\favicon-16x16[1].png

Filesize
695B

MD5
7fc6324199de70f7cb355c77347f0e1a

SHA1
d94d173f3f5140c1754c16ac29361ac1968ba8e2

SHA256
97d4556f7e8364fb3e0f0ccf58ab6614af002dfca4fe241095cf645a71df0949

SHA512
09f44601fa449b1608eb3d338b68ea9fd5540f66ea4f3f21534e9a757355a6133ae8fb9b4544f943ca5c504e45a3431bf3f3d24de2302d0439d8a13a0f2d544f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VHEBLS1A\microsoft.windows[1].xml

Filesize
714B

MD5
3f07029bf92309960b73d7f076b8acad

SHA1
f7c3398177f909260b9e87deca48c5e7e2fde125

SHA256
f5a839093d06e1feea9fa6c54346fa2564841e277e36a8a4e371968b873f53cb

SHA512
bfc41abca1942987a3ce628e4ed3982facbb2334295d687a6a08a46b16439067f582c9d15bc25e81ee1f45106ba9e11c284d088e7279895e4908a5d2411a0594

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zC60A890C\Uninst.exe

Filesize
15KB

MD5
b0cec9f342bf95700b602ee376446577

SHA1
b955b1b64280bb0ea873538029cf5ea44081501b

SHA256
24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088

SHA512
05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zC60A890C\Uninst.exe

Filesize
15KB

MD5
b0cec9f342bf95700b602ee376446577

SHA1
b955b1b64280bb0ea873538029cf5ea44081501b

SHA256
24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088

SHA512
05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
275KB

MD5
a592def859f34dca05eed8d59c068b3a

SHA1
0b9a4b397f7a1c06fb5a0117062efebefff7e406

SHA256
dc0eff87da48e33f7ef54e01446bcea8d763d4b644eeae8d608defeb01ef4bfc

SHA512
6708843a999e5ee6a501f7cd04506b44205ce6272d29375e6378b1f31efdee6994e8fff9ffa2b0c18f5f9af45d8e34cc43c9f545ca53f239862353d2379ed2ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
285KB

MD5
82d0d89f3b54def6682b057ecc5d142a

SHA1
d5c7d395b1abb23137397fc8e48a2cf2ce939908

SHA256
ecf50b46a3a6f5bb21d10971bca8e39abdae08b4c834ab0992925c0e7a01fe81

SHA512
55ffe8d2522d233456ce535752f28d2e2a632d3e3ab7d521ce8d580c1bd78df28e813f4bd11dd3ef229512c2d540e7314b18dcf6fd3389f760ee0e872930ca08

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD3C4.tmp\LangDLL.dll

Filesize
7KB

MD5
27cf377d1533f78135bb36ff36b6359f

SHA1
8eda472e1cb83e67c1f118579ef01c1ad06d133a

SHA256
998d77553254e5bd11a4826a2bdc8549d0e28e9199db799b919bc6d15f8b0694

SHA512
f48e597f7d77bd03aa150927234a639c883d2937ee6b24a9f5bd13e70f2b609ae61301ef906ba2f5b047846d2f2818199f5bfb2457618709f2329bd5193d65c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD3C4.tmp\System.dll

Filesize
26KB

MD5
1fddcb352cab98f4bd46583dd6d71501

SHA1
ef7bd2afa119945527fb9e2bdca6024e7622cf55

SHA256
47e565ecd4e5523d6e4969f1108d6ba8894d2577b83e319fe4b53776a8ad5b5b

SHA512
ab5e6c586801bc5ea8914b4bf42823d3a619990b32eecba39195370175a74e3984c9c87e6b01add2670796079f5fe2e44910340dafc9b4a4b2950fee14ed928f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseD3C4.tmp\nsDialogs.dll

Filesize
11KB

MD5
30dcc81f69c5d1790671c05be0e93ec1

SHA1
9db43df563ed5144c0419534f47fad0af4c687c6

SHA256
d43a3ac1b2ddd073c9d20f4391c212cf092c469fdae80a8a632f478205d58b2d

SHA512
7b4019ef62840160c1b285214775a81074f14be4ed674a0dca11cca32a1b7156ef6aaadb85e96a4a34f52a89f473c7488a2116f9cadcb583286a1d352704411f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEBB5.tmp

Filesize
23.2MB

MD5
9e936c2078b286132cd6b9c8602fd17a

SHA1
f638b8a7448daa6da754c9bb2fbf2cf4ee1b007e

SHA256
fa994badb1e90b2629e0d955572ca57efe97169d20d6b4957e2f830e3680da9e

SHA512
6973f1eef2a2baccf2b0bccf5047f6db434698cd483c0b0dfbfcc2230c45bc1ce4a23e67b5ab7ec8767d4cc8d75dcc76eeb347038eabdf5ec99bc12e3a3bb946

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
ad0c1f84b1eb6cff9aa8401045efa405

SHA1
a725715b7b24477b9b4927e2206503351de0bc23

SHA256
83c5060bbdb25defedbb7e62bc785bef7940a3efd936bbbe5cd4ae8b79282aaf

SHA512
ff765bc6cae4fe906cce953d0ec489e8c8a65ee4f03643a5f4227f982ee72c657d5ee1f2bb9b2dfade7c080df0247df74c7c2a4522f2032e23c9d390eda3beab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
2372e82d86f9809246db591a78d5db92

SHA1
8309863fbc318794ee4d227951f8ad1db6c192b7

SHA256
500dfdb4a4335d967337a521a717767941260a2259a373ed7ae81647816884d1

SHA512
6ff28fd54469e1480f9d4879c8275101b793b91b8d15387f0b915bf68b3bc7d055fb17744c8a7b9b5d46c5a14720e70a1393f8e73d5be75edc8b5e5572c5d5d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
9KB

MD5
f1856c0c7ac2162eaf9700da2ef235e6

SHA1
0b1c02d68e1fc8c9cd3fa99cde56c8e4197451c4

SHA256
8c947db57810ed02603ad449613ffce2c413a0ce6e6e4434a252d5f84cfaec8b

SHA512
a567c663dfa8f8e743b7e07745a2d0680e5f6c571912b22c334c32de7f7b9041ddbf4e768f4011e9fad293a30763ffc02fcdad731a1610401c15117e63fb7fe3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\cert9.db

Filesize
224KB

MD5
e959114a1c478db0f824baa998fe29d7

SHA1
2dd488ff9b0bf4aafc16f31d3cb087042179f314

SHA256
c57a43ef43e571fe343c3c945026099075af8f6705e3fc1aea9721b4ade6cfed

SHA512
b0e04b667ab51e3656922daec59fa485b3663417a8ff7857e209080372f85c39fba7efbb74793a16acfdf358d92a9cbbaa9cb983c6beb8d493f79e7b6f49101c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\crashes\store.json.mozlz4.tmp

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\datareporting\glean\db\data.safe.bin

Filesize
182B

MD5
7fba44cb533472c1e260d1f28892d86b

SHA1
727dce051fc511e000053952d568f77b538107bb

SHA256
14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf

SHA512
1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\prefs.js

Filesize
6KB

MD5
cdb5a91b7898f75f98e448e80b41dba6

SHA1
c749651f98e32a2320d2e52fd467fd6217660535

SHA256
ed56bd19352777293cf7195af0fe1412d52e25af6a9a8e2bb04e3e32056556dc

SHA512
b99bca03a398f7e068691852106fe03a90489d1e8230720749c25703e59874765ef706e9e27c9215251372efee84d9c9d0eb636a54e45035d5d2095304fee97b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
c8dc58eff0c029d381a67f5dca34a913

SHA1
3576807e793473bcbd3cf7d664b83948e3ec8f2d

SHA256
4c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17

SHA512
b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
04bf2d84fbeb7bb116ad8e1d0e0ab02b

SHA1
4ee2db29c1003b60285a8a169b6043c9ed119cca

SHA256
77a8710916629b8abf72fedc9482cd9bf65c7600e12952a9d34b1e22d28da798

SHA512
616fb8e52c3f11b23b001e702b7cc2b5acb09f505488fda4b61aa398b38d649ae959219c8dce5d2ab9c3d1153dd8128fffb8cbc6b577e9c9696e8a20bdeb09e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
34179b9b16b4ff5f5a09f772ad553ecb

SHA1
23425ef8c4854f42b0a4cd89eb7b8bdf68318823

SHA256
2ec949d4b04354fd6e0c6d16fb90dab502df0e95d9bb15d4e8a0c837448c5c98

SHA512
1e21daa5c675dd4ec1969e1aaad1cc4b7c7f922a02e1cb37f14796ec799849db66a1b4db3c8695216f59a2bbcb478b0a17d9b83137166a23bad6e8f78531138e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore.jsonlz4

Filesize
3KB

MD5
b90ebc0b7565fa5b23c5ca38b8249f59

SHA1
18c27073c2a5296c7a46b05d7bea3505f1456799

SHA256
298a2583580b30cac5a1978e7e9efb0c1b3a7924943afc04fd231356590255f7

SHA512
e1e937080680ad5ed8a40a65452cd4997120a1fd648a3a3b8590a8122ae90d2a8964e8cbb600a90c771a39c9741a09ce86a40fce8372ab0ea3cbe13ca3cc58d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\sessionstore.jsonlz4

Filesize
7KB

MD5
711ae89475525d4fc8499f7dedaeb62b

SHA1
09b4f18e2dd5114d98ae4170101a2e2fb66cf709

SHA256
52c58b9779797e9867d6a81b4494c41f1f3a7f2cd3a938877ae747e107383487

SHA512
9144d039c4663f217287c40c238266c9d578a6e6b7befd4510fa3cdde064f6fff9d58cfbfad5fef370bfd1ba48d70e4e98b3179b0af116f3125cee3915fdc5a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oqpbz544.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
d79e27bc5aa010082088563efb40ab46

SHA1
1707c659eb1654365ac5ed73af57ddf179453ea1

SHA256
2d89749af37560dd5bc0da486247a0ef2298f9ed74ff117eeb89d19d038ade57

SHA512
d49c1d9c09b8867c38ca75dd9bba8e32d6ebc7b3e6006d202857ffb199a008ee3e78e50f6011128790b6a27e8fcbd5271c63b3d7f5efcbbc836c1c171042d62f

Download Submit
C:\Windows\Installer\MSI15AC.tmp

Filesize
536KB

MD5
f15ef95ebdb50557e7d56de123dfd88c

SHA1
cf4b735ab97d982c7596c18eb2ce0dd5e192235a

SHA256
4339887d03bbd8801bf6bf531e9445e9b2f165aeed71848f46a15a84ca1830ef

SHA512
ebf6f97a2dee732fd952d9ecb943fd476436540dfda1f742ca79a7723f8128872052bd9bd8c7a2e2a062381f0fc2e92cdb8cd93b788425b261a8c77cc5ed16ca

Download Submit
C:\Windows\Installer\MSI1CC1.tmp

Filesize
81KB

MD5
fccdc45ca17e5180b40efc28052bac39

SHA1
cecb5a7e8807e619956183897a64930ce56294d6

SHA256
4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621

SHA512
67a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce

Download Submit
C:\Windows\Installer\MSI428A.tmp

Filesize
81KB

MD5
fccdc45ca17e5180b40efc28052bac39

SHA1
cecb5a7e8807e619956183897a64930ce56294d6

SHA256
4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621

SHA512
67a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce

Download Submit
C:\Windows\Installer\MSI72CD.tmp

Filesize
796KB

MD5
95c185e808b6962dc0f88a6ee8445900

SHA1
e75505add092e5472b6bb95b080c8ae5c82e7f03

SHA256
f420ba35fcef55361d5c5796f26832570d9ae6f04b13c2d0bc6afd157e40fd3a

SHA512
252bdc5c49840448dc810653a5614b13cddecd8a27390d2bb33fb26d52439897153b5f7cea63377aed4f8660f548a9409e19d4abfa109f600b7de646f47b63bc

Download Submit
C:\Windows\Installer\MSIAD34.tmp

Filesize
979KB

MD5
36565c7aa5355f98e059fc031d28ef9c

SHA1
43e2a29f40a9efc2aa4056b946e2eac12d0bff11

SHA256
212b711d72c66dc47603bcee4cfe3e80fea84c818168341082fe7aa12552278c

SHA512
fa3452acdce4322c95eacdcdb5957c409cd1373c269908703c69b9a5a7d5fdb3ce36a4c214d95e1078eef164428c5fea322e183d394e212e24e66c4b2df72330

Download Submit
C:\Windows\Installer\MSIAD34.tmp

Filesize
979KB

MD5
36565c7aa5355f98e059fc031d28ef9c

SHA1
43e2a29f40a9efc2aa4056b946e2eac12d0bff11

SHA256
212b711d72c66dc47603bcee4cfe3e80fea84c818168341082fe7aa12552278c

SHA512
fa3452acdce4322c95eacdcdb5957c409cd1373c269908703c69b9a5a7d5fdb3ce36a4c214d95e1078eef164428c5fea322e183d394e212e24e66c4b2df72330

Download Submit
C:\Windows\Installer\MSID083.tmp

Filesize
418KB

MD5
67f23a38c85856e8a20e815c548cd424

SHA1
16e8959c52f983e83f688f4cce3487364b1ffd10

SHA256
f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40

SHA512
41fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d

Download Submit
C:\Windows\Installer\MSIDAD4.tmp

Filesize
148KB

MD5
be0b6bea2e4e12bf5d966c6f74fa79b5

SHA1
8468ec23f0a30065eee6913bf8eba62dd79651ec

SHA256
6bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164

SHA512
dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b

Download Submit
C:\Windows\Installer\MSIE252.tmp

Filesize
19KB

MD5
9cadbfa797783ff9e7fc60301de9e1ff

SHA1
83bde6d6b75dfc88d3418ec1a2e935872b8864bb

SHA256
c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141

SHA512
095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b

Download Submit
C:\Windows\Installer\MSIE2A8.tmp

Filesize
209KB

MD5
0e91605ee2395145d077adb643609085

SHA1
303263aa6889013ce889bd4ea0324acdf35f29f2

SHA256
5472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b

SHA512
3712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be

Download Submit
C:\Windows\Installer\MSIE746.tmp

Filesize
89KB

MD5
ee6243df5ea48d929da4790efeea45c9

SHA1
9c21d62d7ffca1c68e615eb57bcd5d4ad3d090db

SHA256
0503fcf7646daae6e5445d8c5f248384542d2eeab4c7d8ad3cd5a47759759a48

SHA512
283c6a7bf2bc0b3c2dced9ea7c763c71b6d68c57da6845985f8faaa9cb7649d945a3be2127bbc1e77be792f925e14cff191c9d6bdf821635d438f985feb7753f

Download Submit
C:\Windows\Installer\MSIF84E.tmp

Filesize
81KB

MD5
fccdc45ca17e5180b40efc28052bac39

SHA1
cecb5a7e8807e619956183897a64930ce56294d6

SHA256
4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621

SHA512
67a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
23KB

MD5
61f0e222dbbd852178e970f01973500a

SHA1
c55a5054f96a48f37cce38fb2ce2523a3e5e7dc6

SHA256
322aee3944e24e633bdbe15e7373c83f364d2aa3c4a18116ef87abce52ddbf49

SHA512
32a315ce5af5fbf9b14f5c439d8ba95a9fd94dd8a1e87b644b11665c93eefc17533e41d75ce49239805705c4d44be809ede3299877140d4b378d8c7db832cce0

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
22KB

MD5
64659a5fd858f277dd61183c24a5e29e

SHA1
bbeceb6842fa9b65e9980733b160f8e4c0df7934

SHA256
47e24c728609aa4ef62f60101f6dc7459b651744bb149455892a7e53f6e4fe91

SHA512
c926a5b87909da9a32ee324110a9c4b2ebd00c815999e040de9df645f317c607aad91e9619333bd86df0e9e586505132f91579cd45c060e3f46929ee9e319f05

Download Submit
C:\Windows\Temp\ose00000.exe

Filesize
257KB

MD5
17dc54ade85613728a43f2d733527c5e

SHA1
6420a7744edb234f8cf989b7f261265baa381e94

SHA256
8c47f981e1a46a42a268f53ef1b1476555a54bed7077f7b13b1e562c4c9c049e

SHA512
632541e69c61398c3eb07ea7b8e7a21a6a765b592939f091bf8319cacbf7f294860e5f80c82e8e7ab29e2a20e67dd4d1e34171b2c5858d30ce9b9bcbe167ee43

Download Submit
C:\Windows\Temp\ose00000.exe

Filesize
257KB

MD5
17dc54ade85613728a43f2d733527c5e

SHA1
6420a7744edb234f8cf989b7f261265baa381e94

SHA256
8c47f981e1a46a42a268f53ef1b1476555a54bed7077f7b13b1e562c4c9c049e

SHA512
632541e69c61398c3eb07ea7b8e7a21a6a765b592939f091bf8319cacbf7f294860e5f80c82e8e7ab29e2a20e67dd4d1e34171b2c5858d30ce9b9bcbe167ee43

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
1a94b1222d00651597ddec3b451601a0

SHA1
3d3fea0244b139f3046775eb133add3f56d6b4da

SHA256
d66740fc15c5d4f4eb80c27f0fa99812caa94f24128935328b14111763330060

SHA512
6ef6dd42ef9bb3f725ee4f3e542ea159a513f4e933178e2713b5da598cfb3b75553fb03e0861dd9b54abb2f578a26b68747b1cead07fa86701829b704b0504e7

Download Submit
\??\Volume{ce598122-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{000b1b1c-891b-40d2-b1d7-2eebd7f8db43}_OnDiskSnapshotProp

Filesize
5KB

MD5
349fc5e9041f5d75be8ebc8d9db02fd5

SHA1
226fc7c7560ca19cbf958b89fa5c80fc5a69140b

SHA256
9f9d9a0f802dd761a99c71161bbbb0867e5b685e714f30a1c8fc832b31556201

SHA512
bd69a6d708e3202dfa71e17d76580d340671f34301786948097b341da96eecb762846f215fa18edaf5a4080d08340a103a313a52cc302492d25f1a1c0bfbf434

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
22KB

MD5
98dba4908fa2b949627bfad09850d4a8

SHA1
cfb03a3056a3c6fc9be1d527ceb5bfb2edd467d7

SHA256
e50c884deddbdd2f4a1a0e6f095af52ae58470f184d23a014266273c49b064ea

SHA512
5822815632b6afee7d7edd9bc70a818483fd7eb0ae571a975098f610bf45672fcf128b7abc8f8b8ca0dad244b43956aa762501ec2bd3dc92792f62237e841428

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
23KB

MD5
61f0e222dbbd852178e970f01973500a

SHA1
c55a5054f96a48f37cce38fb2ce2523a3e5e7dc6

SHA256
322aee3944e24e633bdbe15e7373c83f364d2aa3c4a18116ef87abce52ddbf49

SHA512
32a315ce5af5fbf9b14f5c439d8ba95a9fd94dd8a1e87b644b11665c93eefc17533e41d75ce49239805705c4d44be809ede3299877140d4b378d8c7db832cce0

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
23KB

MD5
aa5a4e6177f0446291c199aeb832053c

SHA1
02baf9a858edaa426e434c0ca5a682cc8f031ccb

SHA256
8808b4142922e65b41dff006148e9fd5620399cf60bbb3bfd7b22b33f476ed35

SHA512
183fd0146b67873548bd0023fd8681678a858101025b4c372e407615544905c8d72253def00bb65dc6bb80c20df41fc6a5e7ea5306b08bf99f3b90a169fa2970

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
24KB

MD5
8048a089337fb7f5e14bc0bd49df2cd8

SHA1
106afeea90604989c360eaf3b935e8465c1911d7

SHA256
5a2266b6962b301a28876ee8727e56353cfe50651c02064d11de7aa5a335c391

SHA512
8fd3ac6e560cb4537c4524ba405993de0f9eee1e11d6c7adcf453ef8a38f49b9260f1336b1e00ec19a49f01a77f4ebeec686668430c7e7f9cde4f090b75e59e3

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
24KB

MD5
ca3fac164fac5c945c3acd388b41d616

SHA1
fc7e2f9b757d078a69aaa54c526615cb5c699d33

SHA256
df13e87c84c4c75963a752603e3a895bfdf38201ce3bf886100d7aa13f8f4380

SHA512
d21b75649c5da4fecd7ddb1a8f13cee7924a06f89ac49414b37e3d2fef22f7daad0d73fae7013d66400ae255b36699baf66a0cf846ea43e533c5507d84c56ebc

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
25KB

MD5
c4d421de3ed0a16937dca4bd6dfdf3f4

SHA1
3e9a0394c3f8dfa2edc7c10c2947bdcea4d62e3e

SHA256
dedffada3965c22abf1257be71b6e35b9819c073c059493d3caa29a068c5a6f4

SHA512
9833a222391527c21a7b94d5a62919cf7b74a75f477dc82ae1df0da2560718828cbabaa016108c8155dad3d304099cfbcd826ea818bcbc9dd4ad6c0332f2ee29

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
25KB

MD5
a2b1a6152d5fcd3b278d876ad79bdfc5

SHA1
4ed6dba3919f3fe98e25673b7712d5bb04b0f7bc

SHA256
e73cb865e0588101765b5d7d5680040979d64e7df117bc6a4264e61d891e94b0

SHA512
46fda6654f1ac5fd57594d4b6bc898f5640738a473f9decf152f0e39c29410af2442d07d8a18f41daf3f9b7c0c5ea91f36a74ebde3c2d8701e6ece4d2da3d927

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
26KB

MD5
56143a5bdf6b5dc871f83d66917c57ea

SHA1
b69606edd0de9b2c72284d8097a05cc6f71dfb62

SHA256
38b0b79edcbd7f899a2e42232f046a4d21693144df10df6c8bd2dc2e087feafe

SHA512
d6bfac9f0fd82ed63476eaa490104cbd830475e3ba73dda533ff6e9d322047829ac47ca80581aa4b58ec70ae66efcdaa99da063810a03531ea3d61b0a8ee9791

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
26KB

MD5
cfefb78e15eaabfc0454781f687cb506

SHA1
b11f265a178bd3e798a1f353aa384656b32e119d

SHA256
c444d2f921b03eea69344782b2525d633d7ee26d8ee23f1dde7eb14f0eb358c8

SHA512
e16dc353fe1359864471131c08b16aa5d68680f41b1e6dc3923f19f9cbeab42b2ae33ce1b8106fc19f15f899fdd72ba1f1f38dfcb3a69d8065793a4ea05edac6

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
27KB

MD5
419085e7aefd7e996a61e7440d8158ca

SHA1
ecf80e186c21d179fb0d0c188fa442c4d9a3dd73

SHA256
79b666330e4e337a52647d9855ae4167ad9c864808ceed1f3113e609ab20e27c

SHA512
b837ddb46edf8671b39f491c5800a68c3a133a9d5b203c8d4be628bda5488eb9ded9f8ff5a9830322d37816ea6dbea693878c001db1f18179ca28c56eaacc8b8

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
27KB

MD5
c753b6ed037ab5a4a1ca97da306e1cc4

SHA1
ce60714d71b79c11a3fb749046a574cf115b54ad

SHA256
50db1e178aeb3102635f18a054b2ef7d1dc3254168f5db0d32e479ba0ca53b43

SHA512
15d0ba3f868a04c7e9a62fe1c904dfe45c3d7d5af12de7cd896eb496e1247b1245a187497ac6aae00e68b5b0f46f3030a63d78e5d087d6652806db58d9433fe1

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
28KB

MD5
f4b94a6762324e2e7d88352e6a3e6f28

SHA1
1bd647dced6068a2f0f61891bf26c4e8bb1066dc

SHA256
b3de744ec54d07dfe902372f29301a50b17646231576c7ca123630019129ca97

SHA512
646c74a1aa808d684654793e42913fba82a236a0062d94415c32c4b4f78845aada3e8ebb624d72d0ef65e453c40657ee14d787be30877af3fc241dbd8fa58cbc

Download Submit
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Filesize
28KB

MD5
439771a7ecfe147424e1473bbd92c1b2

SHA1
eede806218e53393c2501088ecbab8f1457de2d6

SHA256
7fbc8d75708d867c17b6f882804482a9bee6246eb6bd7b06241ffc55bd43d330

SHA512
6d80a7bfd28d985e33e41950256d124b6901d44dc0a33d84d297b548ccd71906db896a0b03162ce4cbcb895333b7e21059e3d9c8e591a62490eca250418c15f1

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
22KB

MD5
840b56e03cc6f91f5dd694960f12f312

SHA1
26c1e9017b600f27039db761f68aa00d7c789273

SHA256
4a780d57b547c680b01e4d5440df09833f9e3f2d8a2fa9ab738ce27447ce4e85

SHA512
ad397fa53c13b43a025e01d7b66e2ed6ee78ff9ce370b0878da608479af373b4ca2fcfa83bf279959ec4853fd8a28494d7ecb6f759d844bae20f373e0050c67b

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
22KB

MD5
95e5c3428b9a3668c8c79d5b78317759

SHA1
c24d3d60d3708534c8e89ac2a28698d1e63ffea4

SHA256
97b8c5c6ec7c2c1d81ad02a4bffd99b54eb51c3e933bc856349972dede091f3f

SHA512
37ed4edc695c5d1c0b5981ccc7f0764cd80fc6cb1b0a566bfc38d3c68620937a08871db5598784b0d7a1ac7b34363b847e3d2d2b63d73e74bf8d43b7e11201b8

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
23KB

MD5
fbbda9e17cfd8fd1d371a054f2001e43

SHA1
8ab6fde58f97d0c514f79b4e285fa2c022391bbc

SHA256
28fd709f7f353028f807afff4fcee019ae55b77612a0459b6542bab6cd86ab5e

SHA512
2a2015abe110f29fe9e053deb07b7da1c5ffecb2041ec392785074868fa135ccdca8457d86a009e50d27a6628bcbcb879fa36ec781bae2bf845c2e49bb301766

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
23KB

MD5
301974f1dc83ac98b16cffb75798956b

SHA1
5c57e181467a657aff6cb7549528a2faec7e064f

SHA256
f73024ad6557eb29b2e151d0e7917cb5648e0961186ca9c0437947b0edf5e7b3

SHA512
4f8e1a616e15faa5be31731f2b1849fbc73e0de0edf0841cfed301c792aeb8fb72d37cbd5ae0a0412aa8661556d0594e09bed23a90246ee05b8787f73a4ef869

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
24KB

MD5
6f0d68dae08d66ae399c15e83bd10263

SHA1
9d06ead6652a5efe241e2b4eb032e4eea1f840e5

SHA256
8ca9ef56928755b6b73b00ae63354fcf6d30d6553cf3314133c23299313b3e4c

SHA512
8a56daf15789d527c7d1d8a9d758d921c1632d3540f916dfbc870e87252eaeef0a9a1765faa5f12001dff084a52c938e1b00f1a367ab630a4c7418c46dca6a29

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
24KB

MD5
21b323d093d58c8276872e618770bdd0

SHA1
49fb1d9717626d5c5a1d1ea7e719498f58fcffe1

SHA256
234678dd65df843b8c78ecbb4ea9478070c6562eb5a9da2369491693b4b67193

SHA512
00cf3b41a6dc8053e10f8c14a6a5a14119bde8dd092a8aeecb5a9bf2a25c6e736400a4586aa16fa605f8e4c2ec6178b64a63531c3ed79bc4006fc1541659f2d1

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
25KB

MD5
4977205088cdbb8be150408e22a0423d

SHA1
a86ac0b468c95312e5c94e199fecc4c0cb3ad56a

SHA256
9f2e813957976c74d335b36abeba2d1d49954f8f81682fd98f08c889d2116e51

SHA512
922df8ebe5bd6772b92700a24cc636c6101813322ba5d09042e7e3c07e57aac70e75fe72dc19f024f071533872da54933b94064b7b4a9dcc5a51aec08e203730

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
25KB

MD5
f75cc11c3e2ff66e4effb24dd303d94d

SHA1
e1bfe864b126b6660674b231503080c86a19062e

SHA256
2a5ba9d4fd38258ddebf4fcdea5ee765d02c9e14817d1d3aac4d8463004ceccb

SHA512
4c3b0b7c631eca11e71250d11f2e324c0bb0375ae60666a507ec784a8676095835db281eeb8677534f359e940e8d205483c52734a999b68d377bb65c9ff3ae0e

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
26KB

MD5
5464d8019efa3c44b70875a050c1256e

SHA1
6e6cf42a672f8ad31b9e5d5dc64d860df4473377

SHA256
f76fdfded2264069db4875f3e2a70394a4bb7c991ee171d1587c993d446cc9c0

SHA512
1a8613d9286551d9f9a57e06b75f770dafb313dce294a467280a0101a25dc1ffac8c200b371a67ee71386a9e1e49b41208d4d6b31d49c3c39bdc49e6fa275fda

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
26KB

MD5
3fb4e3893c34e5bc35c2ef740cd333df

SHA1
1a9a0899cc2f32e7319ba4a1cc08d3e66b21cf62

SHA256
4ff182d351d06b511b071cc0fdcdcdb02cf1116e190901f3193a081c0d0d6ad4

SHA512
d2a2dd7a731d4a02e2e7302d43219a1f3645e64bd3887d05ef03c9229307f8fb49515afe7a2c5af0ead39acea63b2ff4e1492df3a2cb7c388fdadcfbe0983255

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
27KB

MD5
613de19fd734271cc9b993caf0cbf560

SHA1
0013b4fcf81ebfafca6fda8a2c60b7454245b993

SHA256
04023140c4f002443680f101813498bd00e4b8138c44f4fbda0f6637c5742f41

SHA512
4a447ca55619a98a41a617b1867337475d50bf2379f19685c4d92a6b209c172fa2db403f7f7a93f05d4555490d42f84275a56474e2372d546f7399162b6baf7c

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
27KB

MD5
8e34f9c9076e9ed43094292bad70272b

SHA1
b990f09c1a50333e5a67e5b827d1d30c2dabf236

SHA256
e28ec5c5d355aa742c239f402ec01598d2e7c1277d94a4155c69245fa685c965

SHA512
695b64f9866847e76133567a03b732fc20631a8f949179a8166809854a37ad7e7274f1042ecd155cc95af846a8e8e674a00360267c2603209200ee435045472a

Download Submit
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log

Filesize
28KB

MD5
e4f9806a615d6757f05ae49bb4240771

SHA1
a9c3f790110b3374ed7075d7637abe88215776ae

SHA256
1406f3ab3814b57b394b4f20e2eccb80f1e91160e8d9dc72e1b1bedeb5b90c9b

SHA512
d67f751a2af8b7c31729d54da6698bfa1fa1e3a3f42474998122aaf552f44c3d053eab3a677baf79b894b4941e7cf85150c37d11ee0babe4671da530e63c2942

Download Submit
\Windows\Installer\MSI15AC.tmp

Filesize
536KB

MD5
f15ef95ebdb50557e7d56de123dfd88c

SHA1
cf4b735ab97d982c7596c18eb2ce0dd5e192235a

SHA256
4339887d03bbd8801bf6bf531e9445e9b2f165aeed71848f46a15a84ca1830ef

SHA512
ebf6f97a2dee732fd952d9ecb943fd476436540dfda1f742ca79a7723f8128872052bd9bd8c7a2e2a062381f0fc2e92cdb8cd93b788425b261a8c77cc5ed16ca

Download Submit
\Windows\Installer\MSI1CC1.tmp

Filesize
81KB

MD5
fccdc45ca17e5180b40efc28052bac39

SHA1
cecb5a7e8807e619956183897a64930ce56294d6

SHA256
4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621

SHA512
67a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce

Download Submit
\Windows\Installer\MSIE252.tmp

Filesize
19KB

MD5
9cadbfa797783ff9e7fc60301de9e1ff

SHA1
83bde6d6b75dfc88d3418ec1a2e935872b8864bb

SHA256
c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141

SHA512
095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b

Download Submit
\Windows\Installer\MSIE746.tmp

Filesize
89KB

MD5
ee6243df5ea48d929da4790efeea45c9

SHA1
9c21d62d7ffca1c68e615eb57bcd5d4ad3d090db

SHA256
0503fcf7646daae6e5445d8c5f248384542d2eeab4c7d8ad3cd5a47759759a48

SHA512
283c6a7bf2bc0b3c2dced9ea7c763c71b6d68c57da6845985f8faaa9cb7649d945a3be2127bbc1e77be792f925e14cff191c9d6bdf821635d438f985feb7753f

Download Submit
\Windows\Installer\MSIF84E.tmp

Filesize
81KB

MD5
fccdc45ca17e5180b40efc28052bac39

SHA1
cecb5a7e8807e619956183897a64930ce56294d6

SHA256
4ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621

SHA512
67a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce

Download Submit
memory/4496-2084-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/4496-2094-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/4496-2067-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/4828-4134-0x00000168D8EE0000-0x00000168D8EE2000-memory.dmp

Filesize
8KB

Download
memory/4828-4133-0x00000168D8EB0000-0x00000168D8EB2000-memory.dmp

Filesize
8KB

Download
memory/4828-4131-0x00000168D48D0000-0x00000168D48D2000-memory.dmp

Filesize
8KB

Download
memory/4828-4129-0x00000168D4890000-0x00000168D4891000-memory.dmp

Filesize
4KB

Download
memory/4828-4108-0x00000168D4600000-0x00000168D4610000-memory.dmp

Filesize
64KB

Download
memory/4828-4089-0x00000168D4220000-0x00000168D4230000-memory.dmp

Filesize
64KB

Download
memory/5820-4140-0x00007FF8496BB000-0x00007FF8496BF000-memory.dmp

Filesize
16KB

Download
memory/6112-2033-0x000002AE8CE40000-0x000002AE8DD02000-memory.dmp

Filesize
14.8MB

Download
memory/6112-3528-0x000002AE8CE40000-0x000002AE8DD02000-memory.dmp

Filesize
14.8MB

Download
memory/6192-3565-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/6192-3004-0x0000000001800000-0x0000000001810000-memory.dmp

Filesize
64KB

Download
memory/6480-3685-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/6600-4249-0x000002676BAB0000-0x000002676BAB2000-memory.dmp

Filesize
8KB

Download
memory/6600-4269-0x000002676B760000-0x000002676B780000-memory.dmp

Filesize
128KB

Download
memory/6600-4257-0x000002676C8C0000-0x000002676C8C2000-memory.dmp

Filesize
8KB

Download
memory/6600-4255-0x000002676C8A0000-0x000002676C8A2000-memory.dmp

Filesize
8KB

Download
memory/6600-4253-0x000002676C880000-0x000002676C882000-memory.dmp

Filesize
8KB

Download
memory/6600-4247-0x000002676BA50000-0x000002676BA52000-memory.dmp

Filesize
8KB

Download
memory/6600-4251-0x000002676BCE0000-0x000002676BCE2000-memory.dmp

Filesize
8KB

Download
memory/6600-4259-0x000002676C8E0000-0x000002676C8E2000-memory.dmp

Filesize
8KB

Download
memory/6600-4245-0x000002676B850000-0x000002676B852000-memory.dmp

Filesize
8KB

Download
memory/6600-4243-0x000002676B7F0000-0x000002676B7F2000-memory.dmp

Filesize
8KB

Download
memory/6600-4214-0x000002676AC00000-0x000002676AD00000-memory.dmp

Filesize
1024KB

Download
memory/6600-4298-0x000002676CE00000-0x000002676CF00000-memory.dmp

Filesize
1024KB

Download
memory/6724-2996-0x0000000000E20000-0x0000000000E2C000-memory.dmp

Filesize
48KB

Download
memory/6724-2997-0x000000001BBB0000-0x000000001BBDC000-memory.dmp

Filesize
176KB

Download
memory/6724-2998-0x000000001BB80000-0x000000001BB8E000-memory.dmp

Filesize
56KB

Download
memory/6764-3734-0x0000000073BE0000-0x0000000073BE9000-memory.dmp

Filesize
36KB

Download
memory/6764-3787-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/6764-3733-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/6764-3789-0x0000000073AF0000-0x0000000073AFE000-memory.dmp

Filesize
56KB

Download
memory/6764-3788-0x0000000073B00000-0x0000000073B0B000-memory.dmp

Filesize
44KB

Download
memory/6764-3819-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download