c68acde54d602e9acf20b3e5148e6b0d933a2353201337a0b97828ab1b7de340

Resubmissions

12/05/2023, 22:52

230512-2tm42aha2v 8

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2023, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EAappInstaller.exe
Size

2.4MB
MD5

f1110a1901aaedae7e072440d8b49e18
SHA1

ebc8448a611d3dcd7ba79fb5441eae1dfd09d409
SHA256

c68acde54d602e9acf20b3e5148e6b0d933a2353201337a0b97828ab1b7de340
SHA512

d67f2350684e044131cb370722750eaad8acba047f550c5c738daf279cc93e53b7e55a6af5829e4bd1e26cb7039a0b9600d45f5f14e42860bc7f367b39546be1
SSDEEP

49152:vT2pZ1kX9GzOcAxgjXE5AcjPqVA9RF2qs/4:vT0cXYKPxY05AcjPhRF274

Score

8^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
77	5268	msiexec.exe
78	5268	msiexec.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	EAappInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe

Executes dropped EXE 9 IoCs

pid	Process
2332	EAappInstaller.exe
4124	EAappInstaller.exe
5976	EABackgroundService.exe
4544	OriginLegacyCLI.exe
5564	EALauncher.exe
4964	EADesktop.exe
1316	EALocalHostSvc.exe
2328	QtWebEngineProcess.exe
232	QtWebEngineProcess.exe

Loads dropped DLL 64 IoCs

pid	Process
2332	EAappInstaller.exe
5796	MsiExec.exe
5796	MsiExec.exe
5796	MsiExec.exe
5876	rundll32.exe
5876	rundll32.exe
5876	rundll32.exe
5876	rundll32.exe
5876	rundll32.exe
2968	MsiExec.exe
6052	rundll32.exe
6052	rundll32.exe
6052	rundll32.exe
6052	rundll32.exe
6052	rundll32.exe
2968	MsiExec.exe
1384	rundll32.exe
1384	rundll32.exe
1384	rundll32.exe
1384	rundll32.exe
1384	rundll32.exe
2968	MsiExec.exe
5060	rundll32.exe
5060	rundll32.exe
5060	rundll32.exe
5060	rundll32.exe
5060	rundll32.exe
2968	MsiExec.exe
2028	rundll32.exe
2028	rundll32.exe
2028	rundll32.exe
2028	rundll32.exe
2028	rundll32.exe
2968	MsiExec.exe
5668	rundll32.exe
5668	rundll32.exe
5668	rundll32.exe
5668	rundll32.exe
5668	rundll32.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
2968	MsiExec.exe
4464	rundll32.exe
4464	rundll32.exe
4464	rundll32.exe
4464	rundll32.exe
4464	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	EAappInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3334fbf5-65e0-4fde-8578-77988a93f0c1} = "\"C:\\ProgramData\\Package Cache\\{3334fbf5-65e0-4fde-8578-77988a93f0c1}\\EAappInstaller.exe\" /burn.runonce"	EAappInstaller.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EAappInstaller.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Origin\Web Cache\prepared\CjXXSD.d	EABackgroundService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Origin\Web Cache\prepared\DIzPbX.d	EABackgroundService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Origin\Web Cache\prepared\pHErdG.d	EABackgroundService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Origin\Web Cache\prepared\QxuxtS.d	EABackgroundService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	EADesktop.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	EADesktop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngine\Controls1Delegates\Menu.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQml\Models.2\qmldir	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Desktop\ComboBoxStyle.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Imagine\ToolButton.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAConnect_microsoft.rcc.enc	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Base\CircularTickmarkLabelStyle.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\translations\qtwebengine_locales\ml.pak	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Layouts\qquicklayoutsplugin.dll	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtGraphicalEffects\Colorize.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\lang\CoreStrings_en_GB.xml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Slider.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Fusion\ApplicationWindow.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebChannel\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Extras\Gauge.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EAEgsProxy.exe	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Base\images\button.png	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.rcc.enc	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5Quick.dll	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\ActionGroup.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Container.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\translations\qtwebengine_locales\he.pak	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\qmltooling\qmldbg_nativedebugger.dll	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Page.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\PatchProgress.exe	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exp	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\lang\CoreStrings_fr_FR.xml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Private\SourceProxy.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\ToolBar.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\ItemDelegate.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Universal\Button.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Universal\Dialog.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick.2\qtquick2plugin.dll	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\DialogButtonBox.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Private\TabBar.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\OriginUninstall.exe	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\qmldir	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Universal\MenuItem.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Base\DialStyle.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt\labs\folderlistmodel\qmlfolderlistmodelplugin.dll	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Fusion\RangeSlider.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Imagine\MenuSeparator.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Fusion\SpinBox.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Universal\MenuBarItem.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Desktop\MenuBarStyle.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Imagine\qmldir	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Base\images\slider-groove.png	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Universal\SpinBox.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Universal\ScrollBar.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtGraphicalEffects\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\Qt5QuickShapes.dll	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\IGO32.dll	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Dialogs\images\warning.png	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls.2\Material\RadioButton.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngine\Controls2Delegates\Menu.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngine\Controls1Delegates\AuthenticationDialog.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\translations\qtwebengine_locales\kn.pak	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\MessageDlg.exe	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\lang\CLIStrings_no_NO.xml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Private\ColumnMenuContent.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\translations\qtwebengine_locales\zh-TW.pak	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngine\Controls1Delegates\MenuSeparator.qml	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Controls\Styles\Base\images\scrollbar-handle-vertical.png	msiexec.exe
File created	C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtQuick\Dialogs\DefaultColorDialog.qml	msiexec.exe

Drops file in Windows directory 44 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB5A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE18E.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI17B3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CB5.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB35.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDD07.tmp-\juno-custom-actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDEAE.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDFE7.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE18E.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}\ProductIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CB5.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e579606.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C2622085-ABD2-49E5-8AB9-D3D6A642C091}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDFE7.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI17B3.tmp-\juno-custom-actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI1CB5.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e579606.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA19F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEAE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEAE.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE18E.tmp-\juno-custom-actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI17B3.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDD07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB50.tmp-\juno-custom-actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDD07.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDEAE.tmp-\juno-custom-actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIE18E.tmp	msiexec.exe
File created	C:\Windows\Installer\e579609.msi	msiexec.exe
File created	C:\Windows\Installer\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}\ProductIcon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI17B3.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB35.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDD07.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDFE7.tmp-\juno-custom-actions.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA326.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB35.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB35.tmp-\juno-custom-actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDB50.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDB50.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIDFE7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CB5.tmp-\juno-custom-actions.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000036d9561f42561000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000036d95610000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900036d9561000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000036d956100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000036d956100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	EABackgroundService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	EABackgroundService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	EABackgroundService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	EABackgroundService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	EABackgroundService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	EABackgroundService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	EABackgroundService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT	EABackgroundService.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133284129157828700"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	EABackgroundService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Location Awareness	EABackgroundService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\SourceList\PackageName = "EAapp-12.184.0.5441-1982.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}\Dependents\{3334fbf5-65e0-4fde-8578-77988a93f0c1}	EAappInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3334fbf5-65e0-4fde-8578-77988a93f0c1}\DisplayName = "EA app"	EAappInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\ = "URL:ealink protocol"	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command	EABackgroundService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\shell\open	EABackgroundService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5802262C2DBA5E94A89B3D6D6A240C19	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open\command	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3334fbf5-65e0-4fde-8578-77988a93f0c1}\ = "{3334fbf5-65e0-4fde-8578-77988a93f0c1}"	EAappInstaller.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}	EAappInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command\ = "\"C:\\Program Files\\Electronic Arts\\EA Desktop\\EA Desktop\\EALauncher.exe\" \"%1\""	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}v12.184.0.5441\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eaconnect.microsoft\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eaconnect.microsoft\shell\open\command	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\PackageCode = "F2B120ADE2BADEA44A82C5A4971ED74D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\DefaultIcon	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eaconnect.microsoft	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell\open\command\ = "\"C:\\Program Files\\Electronic Arts\\EA Desktop\\EA Desktop\\legacyPM\\OriginLegacyCLI.exe\" \"%1\" -wait"	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}\Version = "12.184.0.5441"	EAappInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command	EABackgroundService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\shell	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\URL Protocol	OriginLegacyCLI.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\shell	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command\ = "C:\\Program Files\\Electronic Arts\\EA Desktop\\EA Desktop\\EALauncher.exe \"%1\""	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\ProductIcon = "C:\\Windows\\Installer\\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}\\ProductIcon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eaconnect.microsoft\shell	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command\ = "\"C:\\Program Files\\Electronic Arts\\EA Desktop\\EA Desktop\\EALauncher.exe\" \"%1\""	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\Version = "213385216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3334fbf5-65e0-4fde-8578-77988a93f0c1}\Dependents	EAappInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\ = "URL:ORIGIN Protocol"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\ProductName = "EA app"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink	OriginLegacyCLI.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CC9FD6039AA132C40920B4869A32E4D5\5802262C2DBA5E94A89B3D6D6A240C19	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2548970870-3691742953-3895070203-1000\{CE1B6A23-A128-4625-BB5F-1FA0836102F5}	EALocalHostSvc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eaconnect.microsoft\shell\open	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\shell\open\command\ = "\"C:\\Program Files\\Electronic Arts\\EA Desktop\\EA Desktop\\Link2EA.exe\" \"%1\" \"%2\" \"%3\" \"%4\" \"%5\" \"%6\" \"%7\" \"%8\" \"%9\""	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\ = "URL:ORIGIN Protocol"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\URL Protocol	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command\ = "C:\\Program Files\\Electronic Arts\\EA Desktop\\EA Desktop\\EALauncher.exe \"%1\""	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ealink\DefaultIcon\ = "\"C:\\Program Files\\Electronic Arts\\EA Desktop\\EA Desktop\\legacyPM\\OriginLegacyCLI.exe\",-107"	OriginLegacyCLI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5802262C2DBA5E94A89B3D6D6A240C19\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}v12.184.0.5441\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{3334fbf5-65e0-4fde-8578-77988a93f0c1}\Version = "12.184.0.5441"	EAappInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}\DisplayName = "EA app"	EAappInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{C2622085-ABD2-49E5-8AB9-D3D6A642C091}\Dependents	EAappInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\shell\open\command	EABackgroundService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\link2ea\ = "URL:Link2EA Protocol"	EABackgroundService.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5976	EABackgroundService.exe
4964	EADesktop.exe
1316	EALocalHostSvc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
5064	msedge.exe
5064	msedge.exe
5240	identity_helper.exe
5240	identity_helper.exe
5268	msiexec.exe
5268	msiexec.exe
5268	msiexec.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
2328	QtWebEngineProcess.exe
2328	QtWebEngineProcess.exe
232	QtWebEngineProcess.exe
4888	chrome.exe
4888	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2332	EAappInstaller.exe
Token: SeBackupPrivilege	4848	vssvc.exe
Token: SeRestorePrivilege	4848	vssvc.exe
Token: SeAuditPrivilege	4848	vssvc.exe
Token: SeBackupPrivilege	5616	srtasks.exe
Token: SeRestorePrivilege	5616	srtasks.exe
Token: SeSecurityPrivilege	5616	srtasks.exe
Token: SeTakeOwnershipPrivilege	5616	srtasks.exe
Token: SeShutdownPrivilege	4124	EAappInstaller.exe
Token: SeIncreaseQuotaPrivilege	4124	EAappInstaller.exe
Token: SeSecurityPrivilege	5268	msiexec.exe
Token: SeCreateTokenPrivilege	4124	EAappInstaller.exe
Token: SeAssignPrimaryTokenPrivilege	4124	EAappInstaller.exe
Token: SeLockMemoryPrivilege	4124	EAappInstaller.exe
Token: SeIncreaseQuotaPrivilege	4124	EAappInstaller.exe
Token: SeMachineAccountPrivilege	4124	EAappInstaller.exe
Token: SeTcbPrivilege	4124	EAappInstaller.exe
Token: SeSecurityPrivilege	4124	EAappInstaller.exe
Token: SeTakeOwnershipPrivilege	4124	EAappInstaller.exe
Token: SeLoadDriverPrivilege	4124	EAappInstaller.exe
Token: SeSystemProfilePrivilege	4124	EAappInstaller.exe
Token: SeSystemtimePrivilege	4124	EAappInstaller.exe
Token: SeProfSingleProcessPrivilege	4124	EAappInstaller.exe
Token: SeIncBasePriorityPrivilege	4124	EAappInstaller.exe
Token: SeCreatePagefilePrivilege	4124	EAappInstaller.exe
Token: SeCreatePermanentPrivilege	4124	EAappInstaller.exe
Token: SeBackupPrivilege	4124	EAappInstaller.exe
Token: SeRestorePrivilege	4124	EAappInstaller.exe
Token: SeShutdownPrivilege	4124	EAappInstaller.exe
Token: SeDebugPrivilege	4124	EAappInstaller.exe
Token: SeAuditPrivilege	4124	EAappInstaller.exe
Token: SeSystemEnvironmentPrivilege	4124	EAappInstaller.exe
Token: SeChangeNotifyPrivilege	4124	EAappInstaller.exe
Token: SeRemoteShutdownPrivilege	4124	EAappInstaller.exe
Token: SeUndockPrivilege	4124	EAappInstaller.exe
Token: SeSyncAgentPrivilege	4124	EAappInstaller.exe
Token: SeEnableDelegationPrivilege	4124	EAappInstaller.exe
Token: SeManageVolumePrivilege	4124	EAappInstaller.exe
Token: SeImpersonatePrivilege	4124	EAappInstaller.exe
Token: SeCreateGlobalPrivilege	4124	EAappInstaller.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeBackupPrivilege	5616	srtasks.exe
Token: SeRestorePrivilege	5616	srtasks.exe
Token: SeSecurityPrivilege	5616	srtasks.exe
Token: SeTakeOwnershipPrivilege	5616	srtasks.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe
Token: SeRestorePrivilege	5268	msiexec.exe
Token: SeTakeOwnershipPrivilege	5268	msiexec.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
4964	EADesktop.exe
5064	msedge.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe
4888	chrome.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
5976	EABackgroundService.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
4964	EADesktop.exe
1316	EALocalHostSvc.exe
1316	EALocalHostSvc.exe
1316	EALocalHostSvc.exe
1316	EALocalHostSvc.exe
4964	EADesktop.exe
4964	EADesktop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 2332	664	EAappInstaller.exe	83
PID 664 wrote to memory of 2332	664	EAappInstaller.exe	83
PID 664 wrote to memory of 2332	664	EAappInstaller.exe	83
PID 2332 wrote to memory of 4124	2332	EAappInstaller.exe	89
PID 2332 wrote to memory of 4124	2332	EAappInstaller.exe	89
PID 2332 wrote to memory of 4124	2332	EAappInstaller.exe	89
PID 5064 wrote to memory of 4780	5064	msedge.exe	97
PID 5064 wrote to memory of 4780	5064	msedge.exe	97
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 1508	5064	msedge.exe	98
PID 5064 wrote to memory of 536	5064	msedge.exe	99
PID 5064 wrote to memory of 536	5064	msedge.exe	99
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101
PID 5064 wrote to memory of 1960	5064	msedge.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\EAappInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\EAappInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\Temp\{A386349D-8FFD-44E5-92EC-96F8919AE660}\.cr\EAappInstaller.exe
  "C:\Windows\Temp\{A386349D-8FFD-44E5-92EC-96F8919AE660}\.cr\EAappInstaller.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\EAappInstaller.exe" -burn.filehandle.attached=536 -burn.filehandle.self=696
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\Temp\{85E16CF0-6635-49DF-B5D7-9FF957FFA671}\.be\EAappInstaller.exe
    "C:\Windows\Temp\{85E16CF0-6635-49DF-B5D7-9FF957FFA671}\.be\EAappInstaller.exe" -q -burn.elevated BurnPipe.{49907846-3419-448F-B42F-3B9F93468901} {19E9AF4B-5377-49DF-A205-C7482C2E09E8} 2332
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ff8005846f8,0x7ff800584708,0x7ff800584718
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff60eda5460,0x7ff60eda5470,0x7ff60eda5480
    3⤵
    PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,14995241285643687173,6562871349199285411,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5268
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7C6243CE816B8975C6879ACA62A44EDB
  2⤵
  - Loads dropped DLL
  PID:5796
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIBB35.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240630578 12 juno-custom-actions!JunoCustomActions.JunoCustomActions.InitializeSession
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5876
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI1CB5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240655546 63 juno-custom-actions!JunoCustomActions.JunoCustomActions.LaunchClient
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    PID:4552
  - - C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe
      "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALauncher.exe"
      4⤵
      Executes dropped EXE
      PID:5564
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8BCA640FD72A449AC3072D76701E6D7B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2968
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDB50.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638906 18 juno-custom-actions!JunoCustomActions.JunoCustomActions.CloseOrigin
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:6052
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDD07.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639265 22 juno-custom-actions!JunoCustomActions.JunoCustomActions.BackupCloudSaves
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:1384
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDEAE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240639703 26 juno-custom-actions!JunoCustomActions.JunoCustomActions.UninstallOrigin
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5060
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIDFE7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240640000 30 juno-custom-actions!JunoCustomActions.JunoCustomActions.CreateAdminWritableDirectories
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2028
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE18E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240640421 39 juno-custom-actions!JunoCustomActions.JunoCustomActions.ConfigureRegistry
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Modifies registry class
    PID:5668
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI17B3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240654281 52 juno-custom-actions!JunoCustomActions.JunoCustomActions.ConfigureShortcuts
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x51c
1⤵
PID:2752

C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe
"C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe" -start
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5976
- C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\OriginLegacyCLI.exe
  "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\legacyPM\OriginLegacyCLI.exe" -register
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4544

C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe
"C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EADesktop.exe" -ls=Launcher
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4964
- C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe
  "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EALocalHostSvc.exe" -ipcport=4697
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1316
- C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngineProcess.exe
  "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --use-gl=angle --application-name=EADesktop --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngineProcess.exe
  "C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffffeb89758,0x7ffffeb89768,0x7ffffeb89778
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3220 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3260 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4788 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4948 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4908 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4836 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5536 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5636 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5828 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5728 --field-trial-handle=1840,i,9358616773100645309,15273633012577209552,131072 /prefetch:8
  2⤵
  PID:5476

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e579608.rbs

Filesize
1003KB

MD5
d95a3757a5e7e24625dd3e4cc0b68537

SHA1
5e402ab912b1c5d4dd6e0ccaf9756cc96ceb988e

SHA256
9ca8070ee351865b86cbce5d39ec6f9eb5fbd1eb16c3ed3641fc42a7de841baf

SHA512
466658be6638f4f7f5d2fbe039f4fbecfa3d633441aa6e7ded124a510d9cc0ede61d359094cd8e5531ef07221e3cc579cd40b5ce8deed973ae8ed71650fbc8c8

Download Submit
C:\ProgramData\EA Desktop\machine.ini

Filesize
159B

MD5
c021b7d917e59779d00d25a4b748b241

SHA1
14b74b4fad97790a0d5602e32b787ece5c086eb8

SHA256
929af4e77245453e48c89957c70ea808230b085bb05a83bc1ab4176af959f6f7

SHA512
029828019626afeb5a409c8e5fcf134ddd7fb6eb396f2d397f0c5a2d327a534b002e08c3d8f664aaceda6143db4a0e36f17169349b2facd340aa2407dd102a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
0458359bb800b25cf96b67fa93a6d3db

SHA1
40c02db12aca622ec25c9353528d926e80639172

SHA256
27086dab961b5522e09a12bbe09bdd89a6d851bbce84b734326fe866565fef84

SHA512
9e669c30355652c39686161870ddf3d7837088594acd34dd283d004cef3b3ab245699d0920ee08618095e2d31017323e7144f518ed90b66e2eeb38dd375443a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
d7b26f1eeef3691b8313bbd414e6ff1f

SHA1
9f6df5669cd4a75c245feefae18d51d8626fd542

SHA256
abb5e3b91cd4c7273c7199248dc90631e3d6fffd558559ff4e28c001d9e8b30a

SHA512
c676e30e1177351ebf19ecad4f3b5265340e704c5caa76269922d9c07be0b6e6ed8a667de7385b3af2e01585bfb3d7c1cb4a2a7f0855a4232ba6f4ea90d2167b

Download Submit
C:\Users\Admin\AppData\Local\EADesktop\QtWebEngine\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\EADesktop\QtWebEngine\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\EADesktop\QtWebEngine\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
150KB

MD5
84eb764666ee12c2531447c8038a2c3a

SHA1
008fe9475aeff25bfe6360484aeb2fea01bcfa21

SHA256
f73e368992214d2b7fc2a31ff9dc1723a49a76a886322e740694e6f301e02218

SHA512
febbe839d4a39cd74b5a2e7eb78fcb6aaf83320bca646d6b013b17c85d05d08a60baa0584cd06bd96bc3b009ee9c0d619e27d06852ff6c7ef9f2534b190f5396

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log

Filesize
651B

MD5
9bbfe11735bac43a2ed1be18d0655fe2

SHA1
61141928bb248fd6e9cd5084a9db05a9b980fb3a

SHA256
549953bd4fc8acc868a9374ec684ebd9e7b23939adf551016f3433b642697b74

SHA512
a78c52b2ddc057dabf260eeb744b9f55eab3374ad96e1938a291d2b17f204a0d6e1aa02802de75f0b2cd6d156540d2ddee15e889b89d5e619207054df4c1d483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae2c65ccf1085f2a624551421576a3ee

SHA1
f1dea6ccfbd7803cc4489b9260758b8ad053e08e

SHA256
49bfbbfbdb367d1c91863108c87b4f2f2cfffbbbb5e9c1256344bc7f52038c54

SHA512
3abbfbb4804c6b1d1a579e56a04057f5d9c52cfd48ecbae42d919398f70da2eacd5a35cb3c3d0a559ad3515fadb1734b0d47be48dce0fdd9fd11578948a6c7ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c3770be634be8da92e71a3f9f76d79d3

SHA1
f4538b79d313dd46e55d1fd3e6ca3d4681fe4c3f

SHA256
23549094c00feed7abf21e56caae3c8b22a7bd89cfc2f5ea369cf13259273432

SHA512
09c1a087be6dcb49fd0725936571946266f31298f8ae141d59b9ac60f3f0fe8e7d964f661818d72682633845b48dbb906d8c89bb33bd2060bb4971b3e14fc4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
9b13f2a8f8de9e8da40c4e3e1392574e

SHA1
864fb91867e4c429d8ab821763bf11ce15fba384

SHA256
66094d65d176790840968a73dec5c88cb77d1d573a9cf8c32da223fffe41cba6

SHA512
9e40798ff8b457b8089c26b5745b99cb64dd125f0210894fea156346c767858e71b30af383ba8819bff54a0f9d1319bef0466b3d283fcf310d36570e4cf69806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
38KB

MD5
e4c780a544249a7967b82f07268ef432

SHA1
64b38d103f06b8de4241c62835f67b28a96d286c

SHA256
4d2dc675ba41d56f2aa6cc1286f3f127590c9748f7b4e0bf4c79b0b4bd620a9a

SHA512
74b9135f09dffd7a081889235d2f4c7a343291a4c4458ac69754cdd5790b455b9b98a128561d516202549e83671de13cc4e4b9cfb3ff195dc3d23b42885edf49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
85KB

MD5
45a177b92bc3dac4f6955a68b5b21745

SHA1
eac969dc4f81a857fdd380b3e9c0963d8d5b87d1

SHA256
2db3b6356f027b2185f1ca4bc6b53e64e428201e70e94d1977f8aab9b24afaeb

SHA512
f6a599340db91e2a4f48babd5f5939f87b907a66a82609347f53381e8712069c3002596156de79650511c644a287cbd8c607be0f877a918ae1392456d76b90ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
991KB

MD5
abeb9b869b35759e1f089825d42cd333

SHA1
7be24214eb5a100014d7a31ef89ff4b19823575d

SHA256
047de75a8a4ee683a3c8da31e21ff6cd63c9665f737c7d87766b42f2b0989b00

SHA512
8d7d0b7149d4467fa28727479a7429f046a28ec41ea24462baa433cb5cfb2fe554a09a72cbd9fa0d803965e7d82b3e583ff74608e57476f6a2bc34efec992c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
45KB

MD5
ed41906b0ddc2618580f06d717a3d285

SHA1
54fa871fc6dfa89e1da0e7d81df893e9f45f037d

SHA256
a491fbd67ddab379a67223dc67f3ad88da3b4bdc472b83db0d98eeb1245fef7e

SHA512
a9fe8bd101bc4bd217378f3a5525d27ef7c21d2365cd43110e63632906ba0df0dc7cf9f9976d98b20c38e016657d30e4370be070c4f17a4ed62a5dc85e511124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
db0e7100f850b895c1b711fbb24517b5

SHA1
facf79d21aa0b2d1d0e99d8358416428848de8ef

SHA256
3d0d0b0b40f7544de44887a30099deb36b135b63a71db4967ec42f3bde1c5499

SHA512
0fc7731cd21a34bd54e1d348f759c692f197f7bac376e4cf3cedd90e56b5849295c7a7643f0038ed836ba10f70c78880c8b726d3648e2136d6c1519499017801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
8ca6e39539b5c0392aa731c08de1b26c

SHA1
eeec84ddc6aef7e8d7aa6144cf187d2b2346b807

SHA256
138fdb4255d967c3ba9f45abdd6d632a1392ca78b39d5f867b9fea340c4dbb3d

SHA512
1ca0456e264b00ee6d170ffbc745f1c41c811e7f14f3e594d1deeb54475a2ea346712ec78eaae696c9d01b10b6f45d55f2c4fd676e16afcd9eba4f36adb55953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
ffc1848bc2e2a0021355e964260fdba5

SHA1
459463a81286380183cedf54f1b52add9b1a0392

SHA256
b28bd471ec72be3e02d5d9444e974378719f9c9de767ef83b21de6d61f1a98ff

SHA512
cf22c23a8a6da9d4180fb886a35e41219ee297ef7d4550a2d5258849d42f3238d78ff3afa26f4df3ba8a2ff4c26a5f11324e9c49606308ad7790362634656432

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
396B

MD5
022e2ea4f3ad8922c2cf2a9aa95cc7fc

SHA1
ad8bdeadd8dc7931b8e4702ae6525f5c52f53960

SHA256
efd7c8585c0741c6d63ff4e5ee7d40e327ab22792945be4c3815414ce878c912

SHA512
b4610ea6ae58a7838d8cb290746061954f4bd6ed0765f9579ac58892af5ee41857ccb3851718d09847a5114022a2a7187c10d90d9baa16e1eb825a9ccd8bb3cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
301f36e981d305c534ed9d775f28bd86

SHA1
248d54eb78a725e0d96ce1eb213227e38b5d752a

SHA256
548b46487e9ff6fec213077bcf2dfd8f56a7425da187119ceb3e906674819862

SHA512
982966d0089d4ebf52658f766826facf9207bf13c4d1673127db5adf59cdb421f0a327f333116b6adf2d3ff9864fa6b8640956c6e63805aef9a88023162bfcf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
618889db4ccbdbd1f2e4f56b362a674d

SHA1
3c0b24f642b5d0e3374cbce10791cd22e4c4dbd9

SHA256
6c1e9e7e7009594d0c577e384cff38a654272b9d3bb6c83c552c6f6d267ba5b1

SHA512
931d5021d4e9407d9b7c4f39bc21dbdf7ec81757c395f0dabe1fe3e9353d0704b3c8ea80552c11305f63cfa0043626e1bf11e1cc24c05520f58bc4f5f1ba43ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87835cfb14ad2930c7912358494c5d9f

SHA1
f606afb5df192738259a400ded104eba69cf5555

SHA256
0feba2d6c185faf712d76f59d98bfc7421e7dd087640bdebaf49c386b8bdf8f7

SHA512
6c73ef96a1505d107cdc04cc0986c8ebfe5be8c09ed2ea3ffbdd3847db3b4508b49d1ddf540214def152747390b179ed4c3dce09a8e3c69f670e7949c8e77a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a6399a172040545061b940e78b75435f

SHA1
f92fc00737f1dcf66f29ae4eb026c27d6630981c

SHA256
f61c45cc544ff53449ad7bc76135610379ccd6c17ab734237fc70a09579227a9

SHA512
28a2d5e77321d9dd266c082a2b47a5f4434422df8805d414a1073808cfc98592de8a1d863f1f01c5622b082caff449ff4a2f72cd9bcacf82c1bcceba6263903b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a2e244ab97fd2d86f50d67db1e7c334

SHA1
52caaa441e5bdd5c2de014dc8bf1a98dde0a1804

SHA256
2b46ac82e6ad54db6fa3d8410d96b87533456d38935a1d71e4de3144bdade272

SHA512
f864d6cdf413141269ce22d220fa2bd4255da60ec5762cc92ac6daac529fcf67a16ad0ac92faa64e18d80faccbed196ae5933882f7c97bfdcb348edf85e20f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65622b82667dd3a0a22c8ffd864dea17

SHA1
a9ff899c074825cb80196d8d86aefc3fc9c816f0

SHA256
4b97e2ddfa798127333e34fec17d680658e90dba0f923183e085d8fd9c5a173e

SHA512
738809cf1ee7410039ce42d7d47633f0ac0a022f336044f1dfe4aa9ba4cb9f5817b28d8cf51e9bfac919ff8d9db0d348e24d44101bbb16456d43443c1d3ef9d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9a7e853462a30c7a3b1ec3a93a8ffe0

SHA1
6a1e7634963ffa8b88c183e7494950c274f7b44d

SHA256
7d2af122ecafac055a2eec6363c875d95d3fdb0620d31aea1a87ccf361defe3e

SHA512
10dc0cca8fb75d249736583ea171eddc8f4406a05845ede5e08fdf4125daf91b230a3731a3e9f10ad3a1e217d7bb8b6aa3fa314899a7d70652c6a15af19138fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
cfd585ce0db9a1484f8223dc2cfce2f8

SHA1
4e5e287160c05ecdff8acdfa0899faa5bad4de82

SHA256
0bcae3ddcadfadb917e4f910daefde07af8d2708b7795f3a1146102dcf6cf445

SHA512
b45dd6c3231a79155508d807d4b6f839d49e6120841c4f31147a83039515d3358822fa1fa4ae6f770b4369b96f221326c0b80dc2f0cd99d605440b12c93fb648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b3fbb8a02260d5e41407a7e1af3ee2f6

SHA1
9180c8b9593405936b0fe52272571b63829525d4

SHA256
8c1434a31409aa606a51bdae37e0853597cb408a2cf199f05e02705df3fc15de

SHA512
8a6ec40722054025a8969a80e795b026fc806a0710eb2f9e016feb68cc09a19333404a8a62910e9b0335729fd64e8e1b6250513ffc334dc8d669d96de62eb5d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
f9c1f5e7ed20badd995ee3d2d83a2d9f

SHA1
eea826e399eb1be088d229d02b9fad8cef775164

SHA256
56b10b8746099fb9d810c7d9c2944031a7e341e8cfdca43a0e00b150058e3942

SHA512
58ac09a7317efab895c9999bcfe49d3e81cca68ca777c80428e4325b45e38f1f5b05b849d6e2161580922b96dd775df780715c5125cd342fa59db878b86ca2bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
b41dcf8b78198d826ace0fbb896d9186

SHA1
a1cead5b93726643d40a3854454228e3708ce9d6

SHA256
04d59bf9f3ee18d055e5503514bdc24e49c6d98540a450c40a17069f27708259

SHA512
03657d2ac1b671e8e7c16e8f04d3fc3ab206abe3486b58c3034f1b8f79f5b9d80227b23b1fede9e0263de8ec5f052d87f9695f1d98c247123eb8df28e26a79cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582805.TMP

Filesize
538B

MD5
99ab3113a2b072ebef1f14c4419fb280

SHA1
01db342b2ef0e19e275be8974c09a8f8802691fe

SHA256
53da5c4bd19db556f9edb83ca75d1ca9ba1a8c7ec60017cae139e0b2626d6c56

SHA512
0d932a2e2aaa513a4f78c386f982e0bab12445c483614f937334cade86959a019e572e977974881d26ec6d517f4196c5cad1610b28549f1d4355a0a46496a1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
655a00e6b13f5840abad80643185678d

SHA1
24eb163af2ed043e68c9f017314d8415b3b044e0

SHA256
6e2cbc0451089fa8de6183dc8d0d4ec225fb7d1710c49333d7ab4d61cf1ae008

SHA512
eea9a2ea149eea29995ccca716d3f9a08cc48d3a935988438c2bb803f150debc2f2db6f0d4e9b5a83bb5bc174ebb61d94c08e221c0358dcfb65c839cac9d49b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a5540359c326f69853c2474e3aacd6b0

SHA1
ac4b0c04bb95be331ecf4584479a69650dc574f9

SHA256
f8fba82d07c8582736c3676a1fe3ca3138032845022c90181e012fb118f5ae36

SHA512
ec70cb770189520299b5133be59b5dc466017c13bd25d79924d316ca1656345a657871417e0d0e465b46af48f8177d4c518b179010f8be1bbd0d1d138b0d1117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
2b1ff436943da5f616dae0b081ece616

SHA1
6291e911977502d1519125b125bfe1d463bc9862

SHA256
f7ddd82638dbb7541dfcab17dd6666f801c9df4d387d160797511e3dc5868fa7

SHA512
a0171e62cba8783c946c5a25f8569a299ba1498f9bd8ef9c98220ccf1a87f26a93e653689c067169fdf8a9533965665ce90fcde803530d971993dc0422a1b83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
6b2b14ccfaff154e646bad25e0dd6955

SHA1
07aadfd3052781ebc686b38e7dfeec8832b6264f

SHA256
d8245b969ae42ec994f81039cc796568eec8dde9a0a9a5774ea081da8ee21616

SHA512
19f36a2902e23255d12c1f503bd11dac4c9f8f8a359e22e43856673968b504f48ef9d2b55c6c6e54051fc072b82e80f712e834dd0f851e561b2027c7f6cbfeba

Download Submit
C:\Users\Admin\AppData\Local\Temp\10ae81ea-dfe6-4f27-8d43-7b0648e9eb8d.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\EA_app_20230513005252_000_EAapp_12.184.0.5441_474d36957_e2a669c_1982.msi.log

Filesize
1KB

MD5
4ddc5a6e9432a6da2984356ac128dc27

SHA1
32b569ee93a8ce5997a441a9f0f0f10238e3afc2

SHA256
e2fd8c6d6b2fa22b46a7a54870d1ffd1105618466ab8f5fded6e86fe9153b91a

SHA512
100a87a9b603c8827c7920509fdbc0e7f713173b047f6f5910a55b3c3a6fa81a7f1491c62e5a478ffeeb619212ae8cc3541969fad7657063ab8255ef5f309c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1216059831\6411b46d-cca5-43d1-b5c5-f92cbeeb4466.tmp

Filesize
88KB

MD5
9caa8c614bab0c667ec308c2fc7268d0

SHA1
118810cb2e84e9fb58b45786809e1062c1032658

SHA256
3474c2e016e2e6558afa52729659a90e014e7437be68f8606f9f152f1ba2f8fa

SHA512
85111e6075bd5b5a260684cdcb30718f6b0ea295faeeb5e8e406848597a3e35b62a15cd0977c6a13c62537021db00d0bb2317bfe3773e40028495f4e19bf7369

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1216059831\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1216059831\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_1216059831\CRX_INSTALL\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
d1894c2e67ee52b5039926d630b3d45c

SHA1
76c412e431d9efb3fbdc6af4e1237fb85f579c7f

SHA256
076c249fa38d27663bafa4d1883a5579463b5a35afa0736b672ddb466d275734

SHA512
8b9555235ca798da7b3deaa05c5d86392b56c79e467e86132110332775fb452402a02508a2ee2f05ea3bb4b75c6ae8af1d20fe32c16869b08e5d45791fb11ee3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
d7e5d471b7119a181ec75440e3683a9b

SHA1
1506758154bcf5f8d9453066c4b91c38bdac3600

SHA256
d2ba3de74f7143265a3a7b003441cb0a9b4c2dae0ecd14269d4c2af208dc2f04

SHA512
776022579d24a728c0a67b7c6f0aa13b5e3d679c16ae92d42ca232b1c2e4f0fcdf0614cdc9c0a39da013704b39abe73e1ae6ff9b47d6c1484523de7e05fea9ef

Download Submit
C:\Windows\Installer\MSIA19F.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIA19F.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIA326.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIA326.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIBB35.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIBB35.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIBB35.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIBB35.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIBB35.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIBB35.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIBB35.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDB50.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDB50.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDB50.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDB50.tmp-\CustomAction.config

Filesize
1KB

MD5
64965f9abc00117c97e3cb9580d95310

SHA1
9a924dbe88abac9f6cdde2e9e3251e3d6a308b04

SHA256
5d0428dac1fff42a4c0bec48cd7c65ebf2a5c876871393fb15ffeea2d1f3735d

SHA512
acf152481c7aa9461537c1b6b40c11d818107b28cbf38db0bf72cfb229c0731eb57128ff9124b8476e368490c31c53f7aabff73040938594f63010a6bbca5341

Download Submit
C:\Windows\Installer\MSIDB50.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDB50.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDB50.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDB50.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDB50.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDB50.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDD07.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDD07.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDD07.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDD07.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDD07.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDD07.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDD07.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDD07.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDEAE.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDEAE.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDEAE.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDEAE.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDEAE.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDEAE.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDEAE.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDFE7.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDFE7.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDFE7.tmp

Filesize
252KB

MD5
b83b42ba19b1e6c29799a53bcd0131d6

SHA1
6350cd679d488898336387f36f91fd2562276b2d

SHA256
df9cfffc116c9c5ab5593ea39a70db906353a9749335695d273d31eef849170c

SHA512
9272c76ed59a7733b7b91daa673983fb1e53a4aa5a6b63d8c2e63c919f34d70fda6b876bf1f20739ed2f8aada9628354345d54f182f543a50a3c76131a6cfedb

Download Submit
C:\Windows\Installer\MSIDFE7.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDFE7.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
179KB

MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
C:\Windows\Installer\MSIDFE7.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\MSIDFE7.tmp-\juno-custom-actions.dll

Filesize
26KB

MD5
67f6a27b668d8005225e33aa33e05e26

SHA1
94b9dd7ec915f3fab5896f5e21accb9c6dfc0363

SHA256
45fea9db14042e13848f66c1d49edff1aed26a6bf18a5352d5425958374fc8a1

SHA512
14b624778b652b182b6011261cd5422262262042deac5de2c618e88c69f37eb44d64dd40a3975146f1dfe8439d35846913f02ad8743cd464c8e501e06c989cd8

Download Submit
C:\Windows\Installer\e579609.msi

Filesize
137.8MB

MD5
7c1a134712435e0df9edb5e60c8294bc

SHA1
11fc89a2c3504c77f36f9175c5ae78a9f8e2e358

SHA256
663852c6081b88718225deefb40edffec6a422507a47ee5a347f9e44eebe5792

SHA512
daa04f40fa2c889802278d1e12ab30a04ca9deb92dc08c5c88286dbc9e5eb5803418ecf02b43afa686961b9f0479a5de7e1990af0d6bfe311f0d4c2b01e039f5

Download Submit
C:\Windows\Temp\{85E16CF0-6635-49DF-B5D7-9FF957FFA671}\.ba\juno-bootstrapper-application.dll

Filesize
3.1MB

MD5
8785b794b2bb04e565a2693ebec4a3e8

SHA1
58accc1e18e95596cf7049c2424acb2fbd5a6ffc

SHA256
874b69fa848e33c9e5fd809c3e21e41627a9bbc0448984498d1ae8c99e14d2cf

SHA512
e167bda94ffc0395e1c248fc537017c8bb1215985c0873e57a1a676295ff5d3b729cf19ea7527dcd2b8d91089f5103a0740378d3d1c363f80f6934bb7aeb698b

Download Submit
C:\Windows\Temp\{85E16CF0-6635-49DF-B5D7-9FF957FFA671}\.be\EAappInstaller.exe

Filesize
2.4MB

MD5
f1110a1901aaedae7e072440d8b49e18

SHA1
ebc8448a611d3dcd7ba79fb5441eae1dfd09d409

SHA256
c68acde54d602e9acf20b3e5148e6b0d933a2353201337a0b97828ab1b7de340

SHA512
d67f2350684e044131cb370722750eaad8acba047f550c5c738daf279cc93e53b7e55a6af5829e4bd1e26cb7039a0b9600d45f5f14e42860bc7f367b39546be1

Download Submit
C:\Windows\Temp\{85E16CF0-6635-49DF-B5D7-9FF957FFA671}\.be\EAappInstaller.exe

Filesize
2.4MB

MD5
f1110a1901aaedae7e072440d8b49e18

SHA1
ebc8448a611d3dcd7ba79fb5441eae1dfd09d409

SHA256
c68acde54d602e9acf20b3e5148e6b0d933a2353201337a0b97828ab1b7de340

SHA512
d67f2350684e044131cb370722750eaad8acba047f550c5c738daf279cc93e53b7e55a6af5829e4bd1e26cb7039a0b9600d45f5f14e42860bc7f367b39546be1

Download Submit
C:\Windows\Temp\{85E16CF0-6635-49DF-B5D7-9FF957FFA671}\.be\EAappInstaller.exe

Filesize
2.4MB

MD5
f1110a1901aaedae7e072440d8b49e18

SHA1
ebc8448a611d3dcd7ba79fb5441eae1dfd09d409

SHA256
c68acde54d602e9acf20b3e5148e6b0d933a2353201337a0b97828ab1b7de340

SHA512
d67f2350684e044131cb370722750eaad8acba047f550c5c738daf279cc93e53b7e55a6af5829e4bd1e26cb7039a0b9600d45f5f14e42860bc7f367b39546be1

Download Submit
C:\Windows\Temp\{85E16CF0-6635-49DF-B5D7-9FF957FFA671}\EAapp_12.184.0.5441_474d36957_e2a669c_1982.msi

Filesize
137.8MB

MD5
7c1a134712435e0df9edb5e60c8294bc

SHA1
11fc89a2c3504c77f36f9175c5ae78a9f8e2e358

SHA256
663852c6081b88718225deefb40edffec6a422507a47ee5a347f9e44eebe5792

SHA512
daa04f40fa2c889802278d1e12ab30a04ca9deb92dc08c5c88286dbc9e5eb5803418ecf02b43afa686961b9f0479a5de7e1990af0d6bfe311f0d4c2b01e039f5

Download Submit
C:\Windows\Temp\{A386349D-8FFD-44E5-92EC-96F8919AE660}\.cr\EAappInstaller.exe

Filesize
2.4MB

MD5
f1110a1901aaedae7e072440d8b49e18

SHA1
ebc8448a611d3dcd7ba79fb5441eae1dfd09d409

SHA256
c68acde54d602e9acf20b3e5148e6b0d933a2353201337a0b97828ab1b7de340

SHA512
d67f2350684e044131cb370722750eaad8acba047f550c5c738daf279cc93e53b7e55a6af5829e4bd1e26cb7039a0b9600d45f5f14e42860bc7f367b39546be1

Download Submit
C:\Windows\Temp\{A386349D-8FFD-44E5-92EC-96F8919AE660}\.cr\EAappInstaller.exe

Filesize
2.4MB

MD5
f1110a1901aaedae7e072440d8b49e18

SHA1
ebc8448a611d3dcd7ba79fb5441eae1dfd09d409

SHA256
c68acde54d602e9acf20b3e5148e6b0d933a2353201337a0b97828ab1b7de340

SHA512
d67f2350684e044131cb370722750eaad8acba047f550c5c738daf279cc93e53b7e55a6af5829e4bd1e26cb7039a0b9600d45f5f14e42860bc7f367b39546be1

Download Submit
memory/1316-1884-0x00007FFFFA0C0000-0x00007FFFFA4DA000-memory.dmp

Filesize
4.1MB

Download
memory/1316-1899-0x00000258466B0000-0x00000258466C0000-memory.dmp

Filesize
64KB

Download
memory/1316-1886-0x00007FFFFA0C0000-0x00007FFFFA4DA000-memory.dmp

Filesize
4.1MB

Download
memory/1316-2478-0x00000258466B0000-0x00000258466C0000-memory.dmp

Filesize
64KB

Download
memory/1316-1883-0x00007FFFEB310000-0x00007FFFEB86F000-memory.dmp

Filesize
5.4MB

Download
memory/2028-660-0x0000000003140000-0x0000000003150000-memory.dmp

Filesize
64KB

Download
memory/2028-665-0x0000000003140000-0x0000000003150000-memory.dmp

Filesize
64KB

Download
memory/2028-664-0x0000000003140000-0x0000000003150000-memory.dmp

Filesize
64KB

Download
memory/2028-659-0x0000000003140000-0x0000000003150000-memory.dmp

Filesize
64KB

Download
memory/4464-1778-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/4464-1779-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/4464-1790-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/4464-1791-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/4964-1892-0x0000022B157D0000-0x0000022B159D0000-memory.dmp

Filesize
2.0MB

Download
memory/4964-2122-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-1832-0x00007FFFFA0C0000-0x00007FFFFA4DA000-memory.dmp

Filesize
4.1MB

Download
memory/4964-1888-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1962-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-2091-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2092-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2094-0x0000022B191B0000-0x0000022B191B1000-memory.dmp

Filesize
4KB

Download
memory/4964-2096-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2095-0x0000022B191B0000-0x0000022B191B1000-memory.dmp

Filesize
4KB

Download
memory/4964-2097-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2098-0x0000022B191B0000-0x0000022B191B1000-memory.dmp

Filesize
4KB

Download
memory/4964-2108-0x0000022B19550000-0x0000022B19552000-memory.dmp

Filesize
8KB

Download
memory/4964-2109-0x0000022B19550000-0x0000022B19552000-memory.dmp

Filesize
8KB

Download
memory/4964-1889-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-2110-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2111-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2112-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2114-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2113-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2115-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2117-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2118-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2116-0x0000022B19560000-0x0000022B19563000-memory.dmp

Filesize
12KB

Download
memory/4964-2119-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2120-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2121-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-1890-0x0000022B15390000-0x0000022B157D0000-memory.dmp

Filesize
4.2MB

Download
memory/4964-2123-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2124-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2126-0x0000022B19550000-0x0000022B19552000-memory.dmp

Filesize
8KB

Download
memory/4964-2125-0x0000022B19550000-0x0000022B19552000-memory.dmp

Filesize
8KB

Download
memory/4964-2127-0x0000022B19550000-0x0000022B19552000-memory.dmp

Filesize
8KB

Download
memory/4964-2128-0x0000022B19180000-0x0000022B19181000-memory.dmp

Filesize
4KB

Download
memory/4964-2129-0x0000022B19550000-0x0000022B19552000-memory.dmp

Filesize
8KB

Download
memory/4964-2289-0x0000022B0E870000-0x0000022B0E880000-memory.dmp

Filesize
64KB

Download
memory/4964-1887-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1881-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1882-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1885-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1878-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1880-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1877-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1876-0x00007FF81DFB0000-0x00007FF81DFC0000-memory.dmp

Filesize
64KB

Download
memory/4964-1833-0x00007FFFEB310000-0x00007FFFEB86F000-memory.dmp

Filesize
5.4MB

Download
memory/4964-1863-0x0000022B0E870000-0x0000022B0E880000-memory.dmp

Filesize
64KB

Download
memory/4964-1844-0x00007FFFFA0C0000-0x00007FFFFA4DA000-memory.dmp

Filesize
4.1MB

Download
memory/5876-536-0x0000000004810000-0x000000000483E000-memory.dmp

Filesize
184KB

Download
memory/5876-542-0x0000000004850000-0x000000000485C000-memory.dmp

Filesize
48KB

Download
memory/5976-1895-0x0000023FD2EA0000-0x0000023FD2EB0000-memory.dmp

Filesize
64KB

Download
memory/5976-1566-0x0000023FD2EA0000-0x0000023FD2EB0000-memory.dmp

Filesize
64KB

Download
memory/5976-1557-0x00007FFFEB310000-0x00007FFFEB86F000-memory.dmp

Filesize
5.4MB

Download
memory/5976-1558-0x00007FFFFA0C0000-0x00007FFFFA4DA000-memory.dmp

Filesize
4.1MB

Download
memory/6052-598-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/6052-1516-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download