Analysis
-
max time kernel
1694s -
max time network
1748s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 22:19
Static task
static1
Behavioral task
behavioral1
Sample
Setup.js
Resource
win11-20240412-en
General
-
Target
Setup.js
-
Size
154KB
-
MD5
fbfe4e161a1f4a249fb5dd0b79755ca3
-
SHA1
51e4dd8eb9b381a6385060f22fbb50016228b858
-
SHA256
c384c2f5998845c9ab44484a3f8d8d0aa88b9cdb658d4e0250656354f1e351d7
-
SHA512
a64ea7a919d833f01d14a249df3e99b2c2f762995459d508abcf20d4c9db1545c2c532b0674464a8f3e218781fe37feb660eebd2a90bdbc73be6244f3ec5d07c
-
SSDEEP
3072:EIHm8ZyrTBcKLOuLLZaoA9V+hg3XcqyvMpzi70A7qqHpBelk:efLLZaoA9V+hg3XcqWMpzi70Auk
Malware Config
Extracted
lumma
https://alcojoldwograpciw.shop/api
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
iexplore.exeiexplore.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4396 3732 iexplore.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5416 2536 iexplore.exe -
Manipulates Digital Signatures 1 TTPs 13 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
Processes:
integrator.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLREMOVESIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\DIAGNOSTICPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLVERIFYINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\FINALPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTIFICATE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958} integrator.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
setup.exeMsiExec.exesetup.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{8A69D345-D564-463C-AFF1-A69D9E530F96} setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000} MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} setup.exe -
Sets file execution options in registry 2 TTPs 24 IoCs
Processes:
integrator.exemsiexec.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe integrator.exe -
Executes dropped EXE 50 IoCs
Processes:
7z2301-x64.exe7zG.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exe7zG.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeCodex.exeMSI103C.tmpFullTrustNotifier.exeMSI46C6.tmpose.exeose00000.exeUninstall.exeUninst.exeUn_A.exeUn_A.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exepid process 5200 7z2301-x64.exe 4104 7zG.exe 2844 Codex.exe 6132 Codex.exe 4628 Codex.exe 4624 Codex.exe 1700 Codex.exe 2140 Codex.exe 3120 Codex.exe 5480 7zG.exe 1556 Setup.exe 3860 Setup.exe 4344 Setup.exe 4920 Setup.exe 1480 Setup.exe 2092 Setup.exe 5516 Setup.exe 3472 Setup.exe 4068 Setup.exe 480 Codex.exe 3940 MSI103C.tmp 2148 FullTrustNotifier.exe 996 MSI46C6.tmp 5292 ose.exe 5736 ose00000.exe 1680 Uninstall.exe 6108 Uninst.exe 6020 Un_A.exe 3476 Un_A.exe 6064 Setup.exe 5828 Setup.exe 5764 Setup.exe 5016 Setup.exe 6100 Setup.exe 6104 Setup.exe 4288 Setup.exe 4612 Setup.exe 4168 Setup.exe 5324 Setup.exe 4716 Setup.exe 4004 Setup.exe 1072 Codex.exe 1092 Codex.exe 3428 Codex.exe 2476 Codex.exe 476 Codex.exe 4100 Codex.exe 4456 Codex.exe 1860 Codex.exe 4716 Codex.exe -
Loads dropped DLL 64 IoCs
Processes:
7zG.exe7zG.exeMsiExec.exeMsiExec.exeMSI46C6.tmppid process 3288 4104 7zG.exe 5480 7zG.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 824 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 2764 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 824 MsiExec.exe 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp 996 MSI46C6.tmp -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
OneDriveSetup.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx OneDriveSetup.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MSI46C6.tmpmsiexec.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0078-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0097-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0180-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0256-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0046-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0278-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0290-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0124-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0045-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0090-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0178-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0267-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0257-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0183-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0038-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0200-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0271-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0096-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0311-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0355-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0206-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0214-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0253-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E101-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0099-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0342-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0076-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020819-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 msiexec.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0071-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0127-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0264-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0100-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0065-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0340-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0380-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0032-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0072-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0242-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0086-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0052-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0174-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0344-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0319-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0102-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0151-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0253-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0170-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0060-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0212-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0034-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0180-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0073-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
windowsdesktop-runtime-7.0.16-win-x64.exevcredist_x64.exeVC_redist.x86.exewindowsdesktop-runtime-6.0.27-win-x64.exewindowsdesktop-runtime-8.0.2-win-x64.exevcredist_x86.exevcredist_x86.exevcredist_x64.exeVC_redist.x64.exeOneDriveSetup.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef5af41f-d68c-48f7-bfb0-5055718601fc} = "\"C:\\ProgramData\\Package Cache\\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\\windowsdesktop-runtime-7.0.16-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-7.0.16-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} = "\"C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_amd64_20240420223821.log\" /uninstall ignored /burn.runonce" vcredist_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{4d8dcf8c-a72a-43e1-9833-c12724db736e} = "\"C:\\ProgramData\\Package Cache\\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\\VC_redist.x86.exe\" /burn.runonce" VC_redist.x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d87ae0f4-64a6-4b94-859a-530b9c313c27} = "\"C:\\ProgramData\\Package Cache\\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\\windowsdesktop-runtime-6.0.27-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-6.0.27-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{63880b41-04fc-4f9b-92c4-4455c255eb8c} = "\"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\windowsdesktop-runtime-8.0.2-win-x64.exe\" /burn.runonce" windowsdesktop-runtime-8.0.2-win-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{61087a79-ac85-455c-934d-1fa22cc64f36} = "\"C:\\ProgramData\\Package Cache\\{61087a79-ac85-455c-934d-1fa22cc64f36}\\vcredist_x86.exe\" /burn.runonce" vcredist_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20240420223831.log\" /uninstall ignored /burn.runonce" vcredist_x86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{ef6b00ec-13e1-4c25-9064-b2f383cb8412} = "\"C:\\ProgramData\\Package Cache\\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\\vcredist_x64.exe\" /burn.runonce" vcredist_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13} = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Uninstall 18.151.0729.0013 = "C:\\Windows\\system32\\cmd.exe /q /c rmdir /s /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\"" OneDriveSetup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 5 IoCs
Processes:
msiexec.exeOneDriveSetup.exesvchost.exesetup.exechrome.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini msiexec.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini OneDriveSetup.exe File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini setup.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini chrome.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
MSI46C6.tmpintegrator.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects integrator.exe -
Drops file in System32 directory 64 IoCs
Processes:
msiexec.exeMsiExec.exeOfficeClickToRun.exeintegrator.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exedescription ioc process File opened for modification \??\c:\Windows\SysWOW64\vcomp100.dll msiexec.exe File opened for modification C:\Windows\system32\mfc110fra.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcr120.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfc100u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120.dll msiexec.exe File opened for modification C:\Windows\system32\mfc120jpn.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120ita.dll msiexec.exe File opened for modification C:\Windows\system32\mfc110cht.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp110.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm120.dll msiexec.exe File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe File opened for modification \??\c:\Windows\SysWOW64\atl100.dll msiexec.exe File opened for modification C:\Windows\system32\atl110.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120deu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110jpn.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe File opened for modification C:\Windows\SysWOW64\mfc120enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm integrator.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe File opened for modification \??\c:\Windows\SysWOW64\mfc100esn.dll msiexec.exe File opened for modification \??\c:\Windows\SysWOW64\mfc100jpn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc110kor.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120cht.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-shm OfficeClickToRun.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc120chs.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm120u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\vcamp120.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db integrator.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal integrator.exe File opened for modification \??\c:\Windows\system32\mfcm100.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfc100cht.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfc100ita.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfc100jpn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc110u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110deu.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal OfficeClickToRun.exe File opened for modification C:\Windows\SysWOW64\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110fra.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification \??\c:\Windows\SysWOW64\mfc100.dll msiexec.exe File opened for modification \??\c:\Windows\SysWOW64\mfc100cht.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db OfficeClickToRun.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfc100rus.dll msiexec.exe File opened for modification \??\c:\Windows\system32\mfc100esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc110chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfc110ita.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc110cht.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm120.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.bak.db OfficeClickToRun.exe -
Suspicious use of SetThreadContext 38 IoCs
Processes:
Codex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeCodex.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exeCodex.exedescription pid process target process PID 2844 set thread context of 4128 2844 Codex.exe RegAsm.exe PID 6132 set thread context of 4084 6132 Codex.exe RegAsm.exe PID 4628 set thread context of 5764 4628 Codex.exe RegAsm.exe PID 4624 set thread context of 2552 4624 Codex.exe RegAsm.exe PID 1700 set thread context of 5208 1700 Codex.exe RegAsm.exe PID 2140 set thread context of 3936 2140 Codex.exe RegAsm.exe PID 3120 set thread context of 6028 3120 Codex.exe RegAsm.exe PID 1556 set thread context of 1600 1556 Setup.exe RegAsm.exe PID 3860 set thread context of 3408 3860 Setup.exe RegAsm.exe PID 4344 set thread context of 5888 4344 Setup.exe RegAsm.exe PID 4920 set thread context of 892 4920 Setup.exe RegAsm.exe PID 1480 set thread context of 2080 1480 Setup.exe RegAsm.exe PID 2092 set thread context of 1804 2092 Setup.exe RegAsm.exe PID 5516 set thread context of 5276 5516 Setup.exe RegAsm.exe PID 3472 set thread context of 3496 3472 Setup.exe RegAsm.exe PID 4068 set thread context of 4652 4068 Setup.exe RegAsm.exe PID 480 set thread context of 5920 480 Codex.exe RegAsm.exe PID 6064 set thread context of 5708 6064 Setup.exe RegAsm.exe PID 5828 set thread context of 3164 5828 Setup.exe RegAsm.exe PID 5764 set thread context of 2232 5764 Setup.exe RegAsm.exe PID 5016 set thread context of 2040 5016 Setup.exe RegAsm.exe PID 6100 set thread context of 5132 6100 Setup.exe RegAsm.exe PID 6104 set thread context of 5352 6104 Setup.exe RegAsm.exe PID 4288 set thread context of 4652 4288 Setup.exe RegAsm.exe PID 4612 set thread context of 5748 4612 Setup.exe RegAsm.exe PID 4168 set thread context of 3160 4168 Setup.exe RegAsm.exe PID 5324 set thread context of 3352 5324 Setup.exe RegAsm.exe PID 4716 set thread context of 2336 4716 Setup.exe RegAsm.exe PID 4004 set thread context of 4296 4004 Setup.exe RegAsm.exe PID 1072 set thread context of 6040 1072 Codex.exe RegAsm.exe PID 1092 set thread context of 1796 1092 Codex.exe RegAsm.exe PID 3428 set thread context of 5952 3428 Codex.exe RegAsm.exe PID 2476 set thread context of 196 2476 Codex.exe RegAsm.exe PID 476 set thread context of 5052 476 Codex.exe RegAsm.exe PID 4100 set thread context of 4304 4100 Codex.exe RegAsm.exe PID 4456 set thread context of 4436 4456 Codex.exe RegAsm.exe PID 1860 set thread context of 4848 1860 Codex.exe RegAsm.exe PID 4716 set thread context of 5904 4716 Codex.exe RegAsm.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Un_A.exemsiexec.exeMsiExec.exemsiexec.exe7z2301-x64.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\ Un_A.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js MsiExec.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll msiexec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll msiexec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb_new.png MsiExec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar msiexec.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libprefetch_plugin.dll Un_A.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-tool-view.js MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js MsiExec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_wob.png MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png MsiExec.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_BR\ Un_A.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2301-x64.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main-selector.css MsiExec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll msiexec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt msiexec.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll Un_A.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\ Un_A.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\ui-strings.js MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png MsiExec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js MsiExec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf msiexec.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif msiexec.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll Un_A.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js MsiExec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Added.txt msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sk_get.svg MsiExec.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json Un_A.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json msiexec.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml Un_A.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\ Un_A.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\ui-strings.js MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png MsiExec.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\ Un_A.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-disabled_32.svg MsiExec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-gb\ui-strings.js MsiExec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll msiexec.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
Processes:
msiexec.exemsiexec.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exengen.exedescription ioc process File opened for modification C:\Windows\Installer\MSI740B.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_base.dll msiexec.exe File opened for modification C:\Windows\Installer\1c1cd.msp msiexec.exe File opened for modification C:\Windows\assembly\pubpol26.dat msiexec.exe File opened for modification C:\Windows\assembly\temp\Y6U178GJXI\Policy.14.0.Microsoft.Office.Interop.PowerPoint.config msiexec.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\comments.aapp msiexec.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File opened for modification C:\Windows\Installer\MSI52EE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8CD6.tmp msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\WindowsMedia.mpp msiexec.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\SystemTemp\~DF99B2850923C33B3B.TMP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA msiexec.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcr100_x64 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\DVA.api msiexec.exe File created C:\Windows\SystemTemp\~DF5B185EE2D97FD4F8.TMP msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100ita_x86 msiexec.exe File opened for modification C:\Windows\Installer\MSI1964.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1250.TXT2 msiexec.exe File opened for modification C:\Windows\assembly\temp\7E9VCX28K3\Microsoft.Office.Interop.SmartTag.dll msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File opened for modification C:\Windows\assembly\temp\N4B7EXT72V\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll msiexec.exe File opened for modification C:\Windows\assembly\temp\XD3LTIW57M\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\weblink.api msiexec.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File opened for modification C:\Windows\Installer\MSIA998.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\B61D15F98E24A4A42882574055142AEA\CacheSize.txt msiexec.exe File opened for modification C:\Windows\Installer\MSIFBD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC2EC.tmp msiexec.exe File opened for modification C:\Windows\assembly\temp\U98UJMDZOZ\OFFICE.DLL msiexec.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File opened for modification C:\Windows\Installer\MSI72D9.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFDA3DE443066A2324.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFE2974421AC470ED7.TMP msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Updater.api_NON_OPT msiexec.exe File opened for modification C:\Windows\Installer\MSIF13D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI64D5.tmp msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfcm100_x86 msiexec.exe File opened for modification C:\Windows\assembly\temp\5LSXP2VVB6\Microsoft.Office.Tools.Word.v9.0.dll msiexec.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\00006109E70000000100000000F01FEC\16.0.12527\vcruntime140.dll_x64 msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File opened for modification C:\Windows\Installer\MSI1CC3.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeXMP.dll msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 11 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exevssvc.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000634f9c04172651690000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000634f9c040000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900634f9c04000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d634f9c04000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000634f9c0400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 53 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exesvchost.exeOfficeClickToRun.exemsiexec.exeOfficeClickToRun.exewermgr.exefirefox.exefirefox.exefirefox.exeintegrator.exefirefox.exeOfficeClickToRun.exefirefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 16 IoCs
Processes:
OfficeClickToRun.exeintegrator.exechrome.exeOfficeClickToRun.exeOfficeClickToRun.exewermgr.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU integrator.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe -
Processes:
MSI46C6.tmpiexplore.exemsiexec.exeiexplore.exeintegrator.exeexplorer.exeMsiExec.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\ACTIVEX COMPATIBILITY\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} MSI46C6.tmp Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA} msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B} msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{5852F5ED-8BF4-11D4-A245-0080C6F74284} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{44D1B085-E495-4B5F-9EE6-34795C46E7E7} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} integrator.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31101879" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5054EC7-B9CB-4ad5-9F95-D8171A6D6BFA} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49} integrator.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} integrator.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253} integrator.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions integrator.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1518662426" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253} integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71} integrator.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88} msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} integrator.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4} MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578} msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A} integrator.exe Key created \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
msiexec.exeOfficeClickToRun.exeOfficeClickToRun.exemsiexec.exeOfficeClickToRun.exeintegrator.exeOfficeClickToRun.exeMsiExec.exeMSI46C6.tmpdescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3c msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" integrator.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018000FDA558313 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000cdb7f5410675a7469ba9063f554964f300000000020000000000106600000001000020000000dde12191da5ef6a613f0d5652764875884e6fad00f8573200e13670f6affc0f8000000000e8000000002000020000000d2c27ecc97026204071a1a452ecdcc93b2aa3507ec2ed03ab37071c4a1150cc98000000071898ea2da12e7d0f93edd08fd7d9e75aaa6a54fb6d2d7ee8b17cb8c3e5d7bfb8948756754dfbdad2f2d229f15ae2956cca5f7c8c95a6477b5db3934f1e76b1c0e4da4b8f841768c1642cbbef47bf4f8cf804900d316f791b9017585f1f8e4d5e323348613e610179f6f5189d18af95edc75b86a98fd36bf8169b0bade4e26aa400000003fb3b3cda78b44068e0a9852ec72797b1cfe3eeb25dc14b1e6731add1b6b3c19cde76e88df9c69e9f6d61673752c6562bca9003a91ebb3aab66a27937ac76360 OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Keyboard Layout MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\38 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeClickToRun.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.5 = 61676e6f7374696373222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c22436f6c6c6563746f725c22203a207b205c224576656e74735c22203a207b205c2253746172745472616365436f6c6c6563746f725c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e446f6373222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c22536861726564436f6d6d656e74735f447261667443617264556e6d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224544502a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d736f456e74657270726973654461746150726f74656374696f6e2a5c22203a207b205c224576656e74466c61675c22203a2032207d207d2c205c225375624e616d657370616365735c22203a207b205c22536861726564436f6d6d656e74735c22203a207b205c224576656e74735c22203a207b205c22436f6d6d6974436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166744e61746976655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22447261667453746174654d616e61676572456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22456e644472616674696e675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22506f737444726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465506f7374416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244656c657465546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2245324550657266547261636b65725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224472616674436172644d6f756e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244726166744361726452656e64657265645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224d61726b436f6d6d656e744372656174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656f70656e546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225265736f6c7665546872656164416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22536d6172745265706c79506f737465645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224162616e646f6e44726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469736361726444726166745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436f6d6d656e74436f6e746578744368616e676564416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164436f6d6d656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436c6f7365566965774576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6e74657874437265617465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684f70656e566965774576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368566965774368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368426567696e44726166744576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684361706162696c69746965734368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6d6d656e74734368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368436f6d6d656e7453656c65637465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368437265617465436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368446f634368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368456e64436f6d6d656e7453657373696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368456e6444726166744576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368466f63757350616e655472696767657265644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e6974436f6d6d656e7453657373696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e697469616c52656e646572436f6d706c657465644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224469737061746368496e76616c69644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463684c6f6164546872656164735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e654368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e65466f63757353746174654368616e6765644576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636850616e65546f52656e6465724576656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636853656c656374436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636853657448616c6650616e65446973706c61794d6f64655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2244697370617463685468656d654368616e6765645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446973706174636844656c657465436f6d6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22436c656172436f6d6d656e7453656c656374696f6e416374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e74416374697669746965735c22203a207b205c224576656e74735c22203a207b205c2241637469766974794c6f6744697363617264466f72446f63756d656e744368616e67655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67547269676765724173796e635461736b576f726b65725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654c6f61644173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e697446696c65506174685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565417070656e644173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565577269746541637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756552656d6f76654173796e6342617463685c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655772697465446f63756d656e74496e666f4865616465725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756554727944656c657465456d70747946696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565496e7365727441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e717565756541637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674372656174654c6f675c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67536176654e657746696c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654c6f63616c4e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e674e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575654469736361726441637469766974794e6f6e437269746963616c5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224170694f70656e41637469766974794c6f675769746853747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6741646441637469766974795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674361636865446f63756d656e74496e666f5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e74727946696e616c697a655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6746696c7465724f757443757272656e7455736572416374697669746965735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674c6f616446726f6d53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f6753617665546f53747265616d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565436865636b5265766f6b65644544505c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565526570616972436f7272757074656446696c654173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f674d6f64696679436c6f6e655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c654f70656e4572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c65526561644572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c655265706c6163654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d6974517565756546696c6557726974654572726f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e4173796e635c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c225472616e736d697451756575655472756e6361746551756575655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c2241637469766974794c6f67456e7472794372656174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e74727953657453746174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536572766963654163746976697479526573756c745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674f6e436f6e74656e74416374696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e717565756541637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f674469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d69745175657565496e7365727441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c225472616e736d697451756575654469736361726441637469766974795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67456e71756575654f7574676f696e675c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2241637469766974794c6f67436c6f73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d6974517565756548656c706572456e737572654469726563746f72795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d697451756575654d616e61676572437265617465496e73616e63655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241706943726561746541637469766974794c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224170694372656174654c6f675c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e736d69745175657565536574456e74657270726973654461746150726f74656374696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2241637469766974794c6f674173796e635461736b5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22436f6c6c6162436f726e65725c22203a207b205c224576656e74735c22203a207b205c22436f617574686f725570646174654c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f617574686f72476f546f43757272656e744c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795573657252655265676973746572436f6e6e65637469766974794368616e67654e6f7469667949664e65636573736172795c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e6443686174427574746f6e497356697369626c654e6f7744617461706f696e745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572436c6f736553696e676c65466c796f75745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64497343686174417661696c61626c655c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665644173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572794f6e436f617574686f72735265747269657665645c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c6572795265747269657665436f617574686f72734265666f72654173796e63506f73745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279496e6974464d5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c657279436f617574686f72577261707065725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c224f666669636543686174436f6d6d616e64436f61757468696e6757697468416c6c4775657374734f724d697373696e67456d61696c456469746f72735c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22476f546f4c6f636174696f6e416374696f6e487562416374696f6e4a756d70546f417574686f725c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465417574686f724c6f636174696f6e5c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6175746847616c6c65727955736572557064617465456d61696c416e64436861745c22203a207b205c224576656e74466c61675c22203a20353132207d2c205c22436f6e7461637443617264416374696f6e487562416374696f6e53686f77436f6e74616374436172645c22203a207b205c224576656e74466c61675c22203a2035 OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\ChunkCount = "uint64_t|11" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" integrator.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" integrator.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\3B\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\49 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\47 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel MSI46C6.tmp Key created \REGISTRY\USER\.DEFAULT\Environment MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe integrator.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\37 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor\ULSTagIds0 = "18679566,5804129,7202269,23978014,39965824,7692557,5850525,34198423,41484365,17962391,17962392" integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion msiexec.exe Key created \REGISTRY\USER\.DEFAULT\System MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\3e msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData\0.9 = 74656446726f6d446f63756d656e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f67436c6f7365645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224469616c6f674f70656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f77496e666f626172436f6e73656e74566965775c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f774c6f6164696e6753746174655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253686f775265616374566965775c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c22416464696e50726566657463685c22203a207b205c224576656e74735c22203a207b205c22507265666574636849636f6e735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c225072656c6f61644d616e69666573745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253616e64626f78507265666574636855726c5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2241637469766174696f6e5c22203a207b205c224576656e74735c22203a207b205c224352656d6f74657250726f78795c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d2c205c2253696e676c655369676e4f6e5c22203a207b205c224576656e74735c22203a207b205c22446973706c617953534f436f6e73656e7450616765466f7241706943616c6c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224578656375746547657453534f546f6b656e496e7465726e616c5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247657441757468546f6b656e5c22203a207b205c224576656e74466c61675c22203a20323536207d207d207d207d2c205c224576656e74735c22203a207b205c224f445041637469766174696f6e466f7254616761353572735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f4450417070436f6d6d616e64735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434f4d416464696e4f7065726174696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f4450417070436f6d6d616e647343616368655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450417070436f6d6d616e6473496e7374616c6c54696d655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450417070436f6d6d616e6473526962626f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224557534c69626c657443616c6c735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67436865636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67446f63756d656e744f70656e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e67446f63756d656e7453686f77547275737455495c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22446565704c696e6b696e675472757374526573756c745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224577734c6173745570646174655374617475734974656d436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224577734c6173745570646174655374617475734974656d53686f776e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247656e314163746976697479416767726567617465644261736553756272756c655c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247656e314163746976697479416767726567617465644661696c757265436f756e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2247656e3141637469766974794167677265676174656453756363657373436f756e74576974685461675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f44504170704d616e6167656d656e744d656e755c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450496e73657274696f6e4469616c6f675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f445050617273654e65774d616e69666573744572726f725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f44505265636f6d6d656e64656447616c6c657279436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f4450526962626f6e427269646765526962626f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f445053616e64626f7841637469766174696f6e5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f45504d616e696665737450617273696e675c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c22526962626f6e427574746f6e436c69636b5c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253746f7265557365725374617475735c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2253746f7265557365725374617475734572726f725c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224f445041637469766174696f6e466f7254616761353572715c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224f44504c6174656e63795c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e466565646261636b222c20225622203a20227374643a3a77737472696e677c7b205c224576656e74735c22203a207b205c2253617665526573706f6e73655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d22207d2c207b20224622203a20224d6963726f736f66742e4f66666963652e54656c656d6574727944796e616d6963436f6e6669672e46696c65494f222c20225622203a20227374643a3a77737472696e677c7b205c225375624e616d657370616365735c22203a207b205c224353495c22203a207b205c224576656e74735c22203a207b205c225265717565737441646170746572556e657870656374656443616c6c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22416d49416c6f6e6550726f63657373526573706f6e73655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e73616374656453747265616d446174615570646174655472616e73616374696f6e436f6d6d69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225472616e73616374656453747265616d446174614d657267655472616e73616374696f6e436f6d6d69745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224343616368656446696c655363686564756c6546696c6555706c6f6164526571756573745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243656c6c53746f726167654f6e426c6f624865617052657175657374526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243656c6c53746f726167654f6e426c6f624865617052657175657374526573756c74434d555c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e49734f6e6c79436c69656e7452657175657374436f6d706c6574655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22437369446176436c69656e7453656e64526571756573745374617475735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22476574446f63756d656e7446726f6d55726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224343616368656446696c654373694c6f616446696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224343616368656446696c654373695361766546696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f63756d656e74466163746f72794372656174654e6577446f63756d656e745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22446f63756d656e7452656e616d655375626d6974576f726b4974656d5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22464d617050617468735c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22476574536861726555726c466f72436f6e7461696e65724173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22476574536861726555726c466f7246696c654173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22476574576f706955726c46726f6d46696c654964656e7469666965724173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2249446f63756d656e7447657456657273696f6e4c6973745c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2249446f63756d656e74526573746f72654173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224973446f776e6c6f616465644261736556616c69644e6f48617368436865636b5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253796e634261636b65645265636f6e63696c65725472795265636f6e63696c65546f4c6174657374416674657256657273696f6e4e6f74466f756e645c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253796e634261636b65645265636f6e63696c65725472616e736974696f6e4f6e6c696e655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2254727944657374726f794f666669636546696c6543616368655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22576f706942726f77736542726f777365546f436f6e7461696e65724173796e635c22203a207b205c224576656e74466c61675c22203a203438383936207d207d2c205c225375624e616d657370616365735c22203a207b205c2253746f726167655c22203a207b205c224576656e74735c22203a207b205c2243616368654f70746963735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f7074696373446f776e6c6f61644572726f72446973747269627574696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f7074696373446f776e6c6f61644572726f72446973747269627574696f6e7337446179735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f70746963734572726f72735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f707469637346696c6553746f726546696c6553697a65446973747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f707469637355706c6f61644572726f72446973747269627574696f6e735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f707469637355706c6f61644572726f72446973747269627574696f6e7337446179735c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f7074696373576f726b696e67436f707946696c6553697a65446973747269627574696f6e5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2252656d6f766546696c65456e7472795c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2243616368654f707469637350657246696c655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2253746172744f666669636546696c6543616368655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d2c205c225375624e616d657370616365735c22203a207b205c2243656e7472616c5461626c655c22203a207b205c224576656e74735c22203a207b205c22436865636b536368656d6156657273696f6e5c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22436c65617243616368655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22437265617465446174616261736546696c655573696e6754656d706c6174655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2243726561746544617461536f757263654661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2244617461736f757263654f70656e4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c2246696c65436163686550726f70657274696573526f774e6f74466f756e645c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224d69677261746546696c654e616d6546726f6d496e695c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22526f77736574556e6b6e6f776e4661696c7572655c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c22536368656d61557067726164655c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d2c205c224661756c744d616e6167656d656e745c22203a207b205c224576656e74735c22203a207b205c224661756c745265636f766572795c22203a207b205c224576656e74466c61675c22203a203438383936207d2c205c224661756c745265706f72745c22203a207b205c224576656e74466c61675c22203a203438383936207d207d207d207d207d207d207d2c205c2250726f746f636f6c5061727365725c22203a207b205c224576656e74735c22203a207b205c2250617273655572695c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b55726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22496672496e697441726773576f72645c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2248724c61756e636855726c5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22464c6f6164436d644c696e65436f72655c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c2250726f746f636f6c48616e646c65725c22203a207b205c224576656e74735c22203a207b205c225472794f70656e696e674c6f7248797065724c696e6b496e4e6174697665436c69656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2250726f746f636f6c48616e646c65724d61696e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22556e7061636b4c696e6b5c22203a207b205c224576656e74735c22203a207b205c22556e7061636b4c696e6b5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b4c696e6b4173796e635c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22556e7061636b4c696e6b5769746848696e745c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c225254435c22203a207b205c224576656e74735c22203a207b205c2246696e6453657373696f6e456e64706f696e7452756e5c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22446f63756d656e74536861726555726c5c22203a207b205c224576656e74735c22203a207b205c22556e7061636b536861726555726c416e6448616e646c65526573756c745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224f6e556e7061636b55726c436f6d706c657465645c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c22486c696e6b5c22203a207b205c224576656e74735c22203a207b205c224d736f4872486c696e6b43726561746546726f6d537472696e675c22203a207b205c224576656e74466c61675c22203a2032207d207d207d2c205c224d534f5c22203a207b205c224576656e74735c22203a207b205c22434d736f4f4c446f634e657744657374727563746f725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f63616c446f63756d656e74496e666f557073656c6c4576656e745c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c224c6f63616c446f63756d656e74496e666f466c796f757444726f707065645c22203a207b205c224576656e74466c61675c22203a20323536207d2c205c2248616e646c65417574684661696c7572655f5573654578697374696e6743726564735f47656e657269634661696c7572655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f4f4c446f6342617365476574504b4d436c69656e7445785c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22434d736f536572766572496e666f476574536572766572496e666f5c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745265636f766572794872476574447270436f72655c22203a207b205c224576656e74466c61675c22203a2032207d2c205c22446f63756d656e745265636f766572794d736f4872426567696e4d6f646966794472705c22203a207b205c224576656e74466c61675c22203a2032207d2c205c225469746c654261725361766555694d616e616765725772697465537461747573546f5469746c654261725c22203a207b205c224576656e74466c61675c22203a2032207d2c205c224c6f6164437369446c6c466f72436c69636b3252756e456e7669726f6e6d656e745c22203a207b205c224576656e74466c61675c22203a2032207d2c205c2249735365727665724361636865645c22203a207b205c22 OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 integrator.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing integrator.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\39 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{2B379600-B42B-4FE9-A59C-A312FB934935}\ApplicationFlags = "1" OfficeClickToRun.exe -
Modifies registry class 64 IoCs
Processes:
MSI46C6.tmpOneDriveSetup.exeOfficeClickToRun.exeintegrator.exemsiexec.exeUn_A.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0042-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0099-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\INTERFACE\{0F872661-C863-47A4-863F-C065C182858A}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{914934ED-5A91-11CF-8700-00AA0060263B}\TypeLib OfficeClickToRun.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0358-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\WOW6432NODE\INTERFACE\{EE15BBBB-9E60-4C52-ABCB-7540FF3DF6B3}\PROXYSTUBCLSID32 OneDriveSetup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.OpenDocuments.5 integrator.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{54679592-3E68-3EC3-93E5-22564D0388E7} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpeg4\shell Un_A.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D0FD779-0C2D-4708-A9BA-62F7458A5A53}\InprocServer32 OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{760681E7-B985-41CE-BCBE-2985A1DFC61C} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.xm\shell\PlayWithVLC\command Un_A.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0091-ABCDEFFEDCBA} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0041-ABCDEFFEDCBB} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0069-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0097-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{359EAB69-7EA9-3179-B5D8-808A3CA74365} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mlp\shell Un_A.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Programmable MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0293-ABCDEFFEDCBC} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DCABF59E-AF88-41D5-92E8-905680968039}\TypeLib OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002097A-0000-0000-C000-000000000046}\ProxyStubClsid32 OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64654B35-A024-4807-89D3-C6FDB5A260C7}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0014-0002-0097-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0278-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetMacroEnabled.12\shell\Edit\ddeexec OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002087A-0000-0000-C000-000000000046}\ProxyStubClsid32 OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wsz\DefaultIcon Un_A.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0103-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0214-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0058-ABCDEFFEDCBA} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6502B78D-944A-36EE-BF60-F6B45716C4ED} msiexec.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0014-0001-0004-ABCDEFFEDCBB}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0156-ABCDEFFEDCBA} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{DA77B198-31E3-312B-83EB-A0CFD52B0085} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.CDAudio\DefaultIcon Un_A.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0221-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EAF0356F-6B2B-4163-A40F-4DD7D6B40A43}\15.0.0.0 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{2811B866-578B-37F2-B7FB-927DD993AB19}\15.0.0.0 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0147-ABCDEFFEDCBA} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002084C-0000-0000-C000-000000000046} OfficeClickToRun.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0290-ABCDEFFEDCBA} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0091-ABCDEFFEDCBC} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244F0-0000-0000-C000-000000000046}\ProxyStubClsid32 OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020818-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244E1-0000-0000-C000-000000000046} OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002094C-0000-0000-C000-000000000046}\ProxyStubClsid32 OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EC4A1BB4-350F-3EE7-AEFC-4A1285432B73} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0106-ABCDEFFEDCBC}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0283-ABCDEFFEDCBB} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{02AF6DD2-77E6-44DF-B3E1-57CF1476D8EA}\DefaultIcon OfficeClickToRun.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0095-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D3B34842-030D-37CB-AD17-0159490BD3A5}\15.0.0.0 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0004-ABCDEFFEDCBA} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C038C-0000-0000-C000-000000000046}\TypeLib OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000244F5-0000-0000-C000-000000000046} OfficeClickToRun.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208D8-0000-0000-C000-000000000046}\TypeLib OfficeClickToRun.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0018-0000-0258-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0048-ABCDEFFEDCBB} MSI46C6.tmp Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0338-0000-0000-C000-000000000046}\TypeLib OfficeClickToRun.exe Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0136-ABCDEFFEDCBB} MSI46C6.tmp Key deleted \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0110-ABCDEFFEDCBA}\INPROCSERVER32 MSI46C6.tmp -
NTFS ADS 3 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\Downloads\Codex.rar:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\7z2301-x64.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Setup.rar:Zone.Identifier firefox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
explorer.exepid process 1892 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
Processes:
taskmgr.exemmc.exemmc.exeexplorer.exetaskmgr.exemmc.exepid process 5432 taskmgr.exe 2316 mmc.exe 2548 mmc.exe 1892 explorer.exe 3236 taskmgr.exe 5476 mmc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
firefox.exeAUDIODG.EXE7z2301-x64.exe7zG.exetaskmgr.exe7zG.exemmc.exedescription pid process Token: SeDebugPrivilege 4120 firefox.exe Token: SeDebugPrivilege 4120 firefox.exe Token: 33 4540 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4540 AUDIODG.EXE Token: SeDebugPrivilege 4120 firefox.exe Token: SeDebugPrivilege 4120 firefox.exe Token: SeDebugPrivilege 4120 firefox.exe Token: SeDebugPrivilege 4120 firefox.exe Token: SeDebugPrivilege 5200 7z2301-x64.exe Token: SeDebugPrivilege 5200 7z2301-x64.exe Token: SeDebugPrivilege 5200 7z2301-x64.exe Token: SeDebugPrivilege 5200 7z2301-x64.exe Token: SeDebugPrivilege 5200 7z2301-x64.exe Token: SeRestorePrivilege 4104 7zG.exe Token: 35 4104 7zG.exe Token: SeSecurityPrivilege 4104 7zG.exe Token: SeSecurityPrivilege 4104 7zG.exe Token: SeDebugPrivilege 5432 taskmgr.exe Token: SeSystemProfilePrivilege 5432 taskmgr.exe Token: SeCreateGlobalPrivilege 5432 taskmgr.exe Token: SeDebugPrivilege 4120 firefox.exe Token: SeDebugPrivilege 4120 firefox.exe Token: SeRestorePrivilege 5480 7zG.exe Token: 35 5480 7zG.exe Token: SeSecurityPrivilege 5480 7zG.exe Token: SeSecurityPrivilege 5480 7zG.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe Token: 33 5400 mmc.exe Token: SeIncBasePriorityPrivilege 5400 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
firefox.exe7zG.exetaskmgr.exepid process 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4104 7zG.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
firefox.exetaskmgr.exepid process 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe 5432 taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
firefox.exe7z2301-x64.exemmc.exemmc.exemmc.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exeOfficeClickToRun.exeintegrator.exeOfficeClickToRun.exeUninstall.exeUninst.exeuninstall.exeUn_A.exefirefox.exewindowsdesktop-runtime-8.0.2-win-x64.exewindowsdesktop-runtime-8.0.2-win-x64.exewindowsdesktop-runtime-8.0.2-win-x64.exewindowsdesktop-runtime-7.0.16-win-x64.exewindowsdesktop-runtime-7.0.16-win-x64.exewindowsdesktop-runtime-7.0.16-win-x64.exesetup.exesetup.exevcredist_x64.exevcredist_x64.exevcredist_x86.exevcredist_x86.exevcredist_x86.exevcredist_x86.exevcredist_x64.exevcredist_x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x64.exeVC_redist.x86.exeVC_redist.x86.exeVC_redist.x86.exewindowsdesktop-runtime-6.0.27-win-x64.exewindowsdesktop-runtime-6.0.27-win-x64.exewindowsdesktop-runtime-6.0.27-win-x64.exeuninstall.exeUn_A.exemaintenanceservice.exefirefox.exepid process 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 4120 firefox.exe 5200 7z2301-x64.exe 5400 mmc.exe 5400 mmc.exe 2316 mmc.exe 2316 mmc.exe 2548 mmc.exe 2548 mmc.exe 5476 OfficeClickToRun.exe 1112 OfficeClickToRun.exe 5352 OfficeClickToRun.exe 5352 OfficeClickToRun.exe 2232 OfficeClickToRun.exe 4500 integrator.exe 3572 OfficeClickToRun.exe 1680 Uninstall.exe 6108 Uninst.exe 5080 uninstall.exe 6020 Un_A.exe 5464 firefox.exe 5464 firefox.exe 5464 firefox.exe 5464 firefox.exe 5464 firefox.exe 5464 firefox.exe 5464 firefox.exe 5256 windowsdesktop-runtime-8.0.2-win-x64.exe 6072 windowsdesktop-runtime-8.0.2-win-x64.exe 256 windowsdesktop-runtime-8.0.2-win-x64.exe 2232 windowsdesktop-runtime-7.0.16-win-x64.exe 3704 windowsdesktop-runtime-7.0.16-win-x64.exe 5308 windowsdesktop-runtime-7.0.16-win-x64.exe 2024 setup.exe 4320 setup.exe 244 vcredist_x64.exe 5708 vcredist_x64.exe 5964 vcredist_x86.exe 640 vcredist_x86.exe 3420 vcredist_x86.exe 4292 vcredist_x86.exe 4896 vcredist_x64.exe 5828 vcredist_x64.exe 5376 VC_redist.x64.exe 1004 VC_redist.x64.exe 6068 VC_redist.x64.exe 476 VC_redist.x86.exe 2524 VC_redist.x86.exe 3476 VC_redist.x86.exe 1928 windowsdesktop-runtime-6.0.27-win-x64.exe 716 windowsdesktop-runtime-6.0.27-win-x64.exe 4044 windowsdesktop-runtime-6.0.27-win-x64.exe 5916 uninstall.exe 3476 Un_A.exe 768 maintenanceservice.exe 128 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 3016 wrote to memory of 4120 3016 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 4220 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe PID 4120 wrote to memory of 3556 4120 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Setup.js1⤵PID:4864
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.0.1906812495\23114365" -parentBuildID 20230214051806 -prefsHandle 1812 -prefMapHandle 1780 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a46092e0-e119-4302-9096-0e9a3fa8e5ed} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 1892 19e4550f658 gpu3⤵PID:4220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.1.333985993\1338168568" -parentBuildID 20230214051806 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 22110 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c2a1de7-7224-48d9-9b9c-afaf5047456c} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 2416 19e31289f58 socket3⤵
- Checks processor information in registry
PID:3556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.2.385006425\1624868699" -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 3040 -prefsLen 22148 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8490aac4-f353-4271-860b-3715a1ddb09f} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 2784 19e48410b58 tab3⤵PID:3456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.3.547619957\673653862" -childID 2 -isForBrowser -prefsHandle 3560 -prefMapHandle 3556 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da26b8dc-e942-4069-8fc5-28fc452aa192} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 3568 19e3127ab58 tab3⤵PID:4412
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.4.751581304\1008885138" -childID 3 -isForBrowser -prefsHandle 5136 -prefMapHandle 1652 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63cf44eb-0d36-4570-9dfc-cab2cdc7aefb} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 1560 19e4ce1c458 tab3⤵PID:2344
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.5.1350562450\1571846889" -childID 4 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0287f46f-cd58-43b3-8147-26aefa36a139} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 5368 19e4d977a58 tab3⤵PID:2504
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.6.1571525945\548808495" -childID 5 -isForBrowser -prefsHandle 5556 -prefMapHandle 5552 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {287404b4-5e6b-4f9f-91a3-c7b30eccbaa5} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 5384 19e4d979e58 tab3⤵PID:1904
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.7.105943763\1656925821" -childID 6 -isForBrowser -prefsHandle 5868 -prefMapHandle 5880 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d768884-c949-48c0-ad17-217ad24762cd} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 5892 19e4e5f6b58 tab3⤵PID:3032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.8.1772097936\2145609524" -childID 7 -isForBrowser -prefsHandle 3464 -prefMapHandle 3724 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e96a7d57-8abd-48a0-9466-ef84e9e68001} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 3476 19e49c28c58 tab3⤵PID:4396
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.9.1052824577\278731268" -parentBuildID 20230214051806 -prefsHandle 3724 -prefMapHandle 3464 -prefsLen 27774 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e55c3c32-890d-4ce2-ad8f-37c0e793fc23} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 5916 19e4e5f8358 rdd3⤵PID:3760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.10.771530292\2082618350" -parentBuildID 20230214051806 -sandboxingKind 1 -prefsHandle 6132 -prefMapHandle 6016 -prefsLen 27774 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7ee340a-edba-425e-920a-ffac517df171} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 6152 19e4ea6f758 utility3⤵PID:4080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.11.1285538885\2133993370" -childID 8 -isForBrowser -prefsHandle 6632 -prefMapHandle 6596 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffde3af7-f4ba-4727-95a5-c86b8e6b9068} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 6636 19e4f6c2a58 tab3⤵PID:3900
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.12.2088885277\1796619743" -childID 9 -isForBrowser -prefsHandle 6740 -prefMapHandle 6744 -prefsLen 27774 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {680a9367-2311-480f-923f-e31f2b70d35c} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 6732 19e4f6c3058 tab3⤵PID:3024
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.13.243759471\1954251448" -parentBuildID 20230214051806 -sandboxingKind 0 -prefsHandle 6992 -prefMapHandle 6764 -prefsLen 27774 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed2e2509-2507-49aa-a77f-83561e6d4f44} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 6544 19e4d603558 utility3⤵PID:5536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.14.681269687\1163648321" -childID 10 -isForBrowser -prefsHandle 7164 -prefMapHandle 5228 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73ef34bb-7537-4f22-a253-cae4427337f9} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 11020 19e4e358e58 tab3⤵PID:996
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.15.1227120985\867498722" -childID 11 -isForBrowser -prefsHandle 3544 -prefMapHandle 3724 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {615325da-b9c2-471d-999c-193018460a1a} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 3824 19e4f261058 tab3⤵PID:5240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.16.1560762909\279818877" -childID 12 -isForBrowser -prefsHandle 10464 -prefMapHandle 10468 -prefsLen 28175 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {023b0955-dc4f-4df9-b661-e6feae3eb166} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 6408 19e448aa558 tab3⤵PID:6128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.17.1277168126\1573797752" -childID 13 -isForBrowser -prefsHandle 1548 -prefMapHandle 1552 -prefsLen 28231 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5ea2231-3dbb-4887-ab7a-f4dc56f6d1f2} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 7096 19e4ac64a58 tab3⤵PID:5432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.18.178204466\1407954014" -childID 14 -isForBrowser -prefsHandle 5016 -prefMapHandle 6520 -prefsLen 28231 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df9cadfb-0f27-42d4-bb9f-caaf33f25912} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 10572 19e4d556c58 tab3⤵PID:3056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.19.510224848\612752176" -childID 15 -isForBrowser -prefsHandle 10016 -prefMapHandle 10744 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca71ef54-26e7-4368-ad5b-130fe0486fbc} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 10012 19e448a7858 tab3⤵PID:392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.20.715868279\236853998" -childID 16 -isForBrowser -prefsHandle 10960 -prefMapHandle 3536 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {547bdbfb-c0e6-47b0-a13a-b2a2fe05fecf} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 10016 19e44879258 tab3⤵PID:2804
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4120.21.189590799\953939912" -childID 17 -isForBrowser -prefsHandle 6256 -prefMapHandle 9816 -prefsLen 28271 -prefMapSize 235121 -jsInitHandle 1028 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba7bb026-189f-4ba4-a378-256f9e29082d} 4120 "\\.\pipe\gecko-crash-server-pipe.4120" 10272 19e31283e58 tab3⤵PID:6000
-
-
C:\Users\Admin\Downloads\7z2301-x64.exe"C:\Users\Admin\Downloads\7z2301-x64.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5200
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:1376
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1176
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap17370:72:7zEvent171581⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4104
-
C:\Users\Admin\Downloads\Codex\Codex.exe"C:\Users\Admin\Downloads\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2844 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4128
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5432
-
C:\Users\Admin\Downloads\Codex\Codex.exe"C:\Users\Admin\Downloads\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6132 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4084
-
-
C:\Users\Admin\Downloads\Codex\Codex.exe"C:\Users\Admin\Downloads\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5764
-
-
C:\Users\Admin\Downloads\Codex\Codex.exe"C:\Users\Admin\Downloads\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2552
-
-
C:\Users\Admin\Downloads\Codex\Codex.exe"C:\Users\Admin\Downloads\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5208
-
-
C:\Users\Admin\Downloads\Codex\Codex.exe"C:\Users\Admin\Downloads\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2140 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3936
-
-
C:\Users\Admin\Downloads\Codex\Codex.exe"C:\Users\Admin\Downloads\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3120 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3632
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:6028
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap20431:72:7zEvent80091⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5480
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1600
-
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3860 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5812
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2540
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3408
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\taskschd.msc"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5400
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\taskschd.msc"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\taskschd.msc"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4344 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5888
-
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:892
-
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2080
-
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1804
-
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5516 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5276
-
-
C:\Users\Admin\Downloads\Setup\Setup.exe"C:\Users\Admin\Downloads\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3496
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5476
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1112
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4652
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5920
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:3420
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:1892 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" /uninstall2⤵PID:1848
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe" C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe /uninstall /permachine /silent /childprocess /enableOMCTelemetry /cusid:S-1-5-21-834482027-582050234-2368284635-10003⤵PID:4068
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveSetup.exe /uninstall /peruser /childprocess /enableOMCTelemetry3⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies registry class
PID:660 -
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncConfig.exe" /uninstall4⤵PID:5596
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Sets file execution options in registry
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5368 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:6072
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0696ED40C2EF5996F99038225C0E9E632⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:824
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 53EDCA2DBEB46587AE24A5843A68753E E Global\MSI00002⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
PID:2764
-
-
C:\Windows\Installer\MSI103C.tmp"C:\Windows\Installer\MSI103C.tmp" /b 3 120 02⤵
- Executes dropped EXE
PID:3940
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts2⤵
- Executes dropped EXE
PID:2148
-
-
C:\Windows\Installer\MSI46C6.tmp"C:\Windows\Installer\MSI46C6.tmp" INSTALLDIR="C:\Program Files\Java\jre-1.8\\" ProductCode={77924AE4-039E-4CA4-87B4-2F64180381F0}2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:996 -
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update3⤵PID:1676
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe" /x {4A03706F-666A-4037-7777-5F2748764D10} /qn4⤵PID:4440
-
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 79276E36B84F53F05E14DB67ADD94D90 E Global\MSI00002⤵PID:4224
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F1EF55440DF655505655DDA75F1072682⤵PID:5352
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B7AF9EF19C8F1601D7FB573A135A14F9 E Global\MSI00002⤵PID:2316
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2B81F29A7DCA1DEAE548760827A86B6C2⤵PID:3428
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C30C2E0DF5466A76EBCC7D780336199A E Global\MSI00002⤵
- Modifies data under HKEY_USERS
PID:4848
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding D08925F6EC8968D5373F8109D4547AE7 E Global\MSI00002⤵PID:1072
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3332
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:2888
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4724
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:328
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"3⤵PID:4316
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll"3⤵PID:2764
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:2528
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3016
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"3⤵PID:2548
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll"3⤵PID:5936
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5752
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1132
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"3⤵PID:5724
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll"3⤵
- Drops file in Windows directory
PID:2336
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2524
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4252
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"3⤵
- Drops file in Windows directory
PID:5748
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll"3⤵
- Drops file in Windows directory
PID:5380
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3348
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3572
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"3⤵PID:4336
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll"3⤵
- Drops file in Windows directory
PID:5484
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5132
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5388
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4724
-
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"3⤵PID:328
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll"3⤵PID:5236
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2880
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5632
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3856
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:6076
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5136
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5752
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1312
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4896
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:3364
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1796
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:4876 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3236
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4004
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2588
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:4640 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3348
-
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:1620
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:4336
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4432
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:932
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5388
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1580
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5292
-
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5684
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2504
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2880
-
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5632
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3856
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:392
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:6000
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:8
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4100
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:788
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3364
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:924
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5748
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"3⤵PID:4704
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll"3⤵
- Drops file in Windows directory
PID:2368
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1116
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5764
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"3⤵PID:5472
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll"3⤵PID:6140
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1348
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1132
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Contract.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:660
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"3⤵PID:5924
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4896
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll"3⤵
- Drops file in Windows directory
PID:4732
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:2856 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4252
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:2912
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"3⤵PID:1808
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll"3⤵
- Drops file in Windows directory
PID:928
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4304
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:6004
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1116
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:3896 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2528
-
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"3⤵PID:2424
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll"3⤵PID:5084
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3156
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5136
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0, Version=9.0.0.00000000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2520
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"3⤵PID:5816
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll"3⤵PID:5364
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"3⤵PID:1796
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll"3⤵PID:5080
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"3⤵PID:5896
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll"3⤵PID:4336
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"3⤵PID:5388
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll"3⤵PID:5764
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5476
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2424
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5936
-
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"3⤵
- Drops file in Windows directory
PID:5060
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll"3⤵PID:3356
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5584
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5456
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4276
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3352
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2116
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1500
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1144
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5740
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2864
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2476
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:6076
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1700
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2064
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3376
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:1708 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2524
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3276
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4852
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:2504
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3748
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3296
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:328
-
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5904
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5132
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5032
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3264
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Excel.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5992
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:6116
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Outlook.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5168
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5816
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4100
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.Office.Tools.Word.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:5924
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:3396
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.ContainerControl, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:2856
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:5820 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4852
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵
- Drops file in Windows directory
PID:3352
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:4364
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe uninstall "Microsoft.VisualStudio.Tools.Office.Runtime.Internal, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"3⤵PID:1116
-
-
\??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue3⤵
- Drops file in Windows directory
PID:2864
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exec:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue3⤵PID:5472
-
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding AE671B1F47A78E63682073C10ED8E866 E Global\MSI00002⤵PID:4412
-
C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe"C:\Program Files\Common Files\Microsoft Shared\Source Engine\ose.exe" -standalone:temp3⤵
- Executes dropped EXE
PID:5292 -
C:\Windows\Temp\ose00000.exe"C:\Windows\Temp\ose00000.exe" -standalone4⤵
- Executes dropped EXE
PID:5736
-
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild3⤵PID:1224
-
-
\??\c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe"c:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild3⤵PID:5060
-
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 4E29291EB7CFADCD440800C45BFEB6C7 E Global\MSI00002⤵PID:228
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4406EA0215E75B907A9BBB57C8B00BAD2⤵PID:1060
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0822A0DB07C902E200E0C887A1E658FA2⤵PID:1700
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 59AEA6808DA66E7BA91840B8D68AA3882⤵PID:2004
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8D6190C5E7C8C3FCCF7DB7FEA4ECFD432⤵PID:6032
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 563E63C27A5A7BE17ADFD77B847C37852⤵PID:4520
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6F17183D4AB97B48B86AD25EF13EB4542⤵PID:3960
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0DBE1F3562BC6BFC1E4C46E7EFB7635D2⤵PID:4652
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 74D92A9F94DE375F0AD965EA68C50E092⤵PID:4204
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5524
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}1⤵PID:5676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:3124
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" scenario=install scenariosubtype=ARP sourcetype=None productstoremove=ProPlusRetail.16_en-us_x-none culture=en-us version.16=16.01⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5352
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2232 -
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"2⤵PID:5608
-
-
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exeintegrator.exe /U /Extension /Msi /License PRIDName=ProPlusRetail.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"2⤵
- Manipulates Digital Signatures
- Sets file execution options in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4500 -
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"3⤵PID:6020
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"3⤵PID:3236
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"3⤵PID:5748
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"3⤵PID:2840
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /standalonesystem2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3572 -
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates"3⤵PID:6020
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Automatic Updates 2.0"3⤵PID:4308
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office Subscription Maintenance"3⤵PID:5528
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2888
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Office ClickToRun Service Monitor"3⤵PID:5480
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /tn "Microsoft\Office\Microsoft Office Touchless Attach Notification"3⤵PID:5388
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1620
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵PID:5908
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Installer\setup.exesetup --uninstall --system-level2⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
PID:4876 -
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6d23eeb10,0x7ff6d23eeb20,0x7ff6d23eeb303⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --suspend-background-mode3⤵PID:2588
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0c5f3cb8,0x7ffa0c5f3cc8,0x7ffa0c5f3cd84⤵PID:1364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,15180142513056302797,15636838280477583277,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:24⤵PID:2808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,15180142513056302797,15636838280477583277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:34⤵PID:4316
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --uninstall3⤵PID:2368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0c5f3cb8,0x7ffa0c5f3cc8,0x7ffa0c5f3cd84⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,18112870477272271537,8366517662611536361,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:24⤵PID:5680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,18112870477272271537,8366517662611536361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:34⤵PID:1008
-
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" um "C:\Users\Admin\AppData\Local\Temp\{3A5F2396-5C8F-4F1F-9B67-6CCA6C990E61}.tmp"3⤵PID:3616
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5896
-
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4876" "2444" "2412" "2440" "0" "0" "0" "0" "0" "0" "0" "0"3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3516
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2696
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3856
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5260
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3364
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:MicrosoftEdge.AppXbnf56tvebb2bnpah2t4s0emv5ws4vxt1.mca1⤵PID:1372
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://go.microsoft.com/fwlink/?linkid=2108824&hl=en&version=90.0.818.66&osVer=10.0.22000&ch=stable&deviceId=s:705CA060-35D7-4E78-A636-2421484C43791⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
PID:4396
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:MicrosoftEdge.AppXbnf56tvebb2bnpah2t4s0emv5ws4vxt1.mca1⤵PID:5584
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:6000
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:788
-
C:\Program Files\7-Zip\Uninstall.exe"C:\Program Files\7-Zip\Uninstall.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\7z5E2A7690\Uninst.exeC:\Users\Admin\AppData\Local\Temp\7z5E2A7690\Uninst.exe /N /D="C:\Program Files\7-Zip\"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6108
-
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:2912
-
C:\Program Files\VideoLAN\VLC\uninstall.exe"C:\Program Files\VideoLAN\VLC\uninstall.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files\VideoLAN\VLC\2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6020 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"3⤵PID:5364
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\VideoLAN\VLC\axvlc.dll"4⤵PID:4724
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:4792
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5464 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.0.1383525737\657614743" -parentBuildID 20230214051806 -prefsHandle 2196 -prefMapHandle 2224 -prefsLen 19310 -prefMapSize 233527 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6464bfe0-38fa-4c63-bab9-0c887cb75c5a} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 2236 222dd3c0058 gpu3⤵PID:5196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.1.1159921894\624138405" -parentBuildID 20230214051806 -prefsHandle 2516 -prefMapHandle 2504 -prefsLen 19310 -prefMapSize 233527 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {04d8b140-8c46-4d02-a1b7-ca83a94dcb46} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 2528 222c9a88d58 socket3⤵
- Checks processor information in registry
PID:1372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.2.2048592683\1197268724" -childID 1 -isForBrowser -prefsHandle 3152 -prefMapHandle 3148 -prefsLen 20133 -prefMapSize 233527 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8db2a2ca-4ccd-4b55-9662-3cad1c1fb551} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 3164 222e0d5a358 tab3⤵PID:736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.3.2037370782\492054873" -childID 2 -isForBrowser -prefsHandle 3780 -prefMapHandle 3776 -prefsLen 20289 -prefMapSize 233527 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {591cfcf1-8978-473a-bdba-179ecfd5d00b} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 3792 222e1779058 tab3⤵PID:780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.4.2127529089\908232747" -parentBuildID 20230214051806 -prefsHandle 4240 -prefMapHandle 4236 -prefsLen 22415 -prefMapSize 233527 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f995ff1-bb99-41ba-84af-56862ce1465f} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 972 222e291b558 rdd3⤵PID:5012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.5.1284396823\1405140266" -childID 3 -isForBrowser -prefsHandle 1748 -prefMapHandle 4936 -prefsLen 29210 -prefMapSize 233527 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b85e216-3828-4574-8314-481fd6e15ebb} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 4848 222e552b958 tab3⤵PID:4916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.6.1013376716\1518302111" -childID 4 -isForBrowser -prefsHandle 4996 -prefMapHandle 5144 -prefsLen 29210 -prefMapSize 233527 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a805672-420e-45cd-9d4e-60f63f153cc5} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 4604 222c9a83b58 tab3⤵PID:2240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.7.605916553\2110021265" -childID 5 -isForBrowser -prefsHandle 5360 -prefMapHandle 5364 -prefsLen 29210 -prefMapSize 233527 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56a8bcd7-2eb9-4107-ba75-5391ac0a5846} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5352 222e7a5c258 tab3⤵PID:2196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.8.236112555\870867973" -childID 6 -isForBrowser -prefsHandle 5720 -prefMapHandle 5716 -prefsLen 29169 -prefMapSize 233527 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {970b7fa0-7f09-4a44-8006-17d371c6e363} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5732 222e7a1e658 tab3⤵PID:5868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5464.9.149154075\1563001294" -childID 7 -isForBrowser -prefsHandle 5216 -prefMapHandle 5048 -prefsLen 29169 -prefMapSize 233527 -jsInitHandle 1328 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c439dc6-f2f7-4678-bd6e-59df08d442e3} 5464 "\\.\pipe\gecko-crash-server-pipe.5464" 5904 222e7553e58 tab3⤵PID:392
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}1⤵PID:5792
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe"C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" /uninstall2⤵
- Suspicious use of SetWindowsHookEx
PID:5256 -
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe"C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 /uninstall3⤵
- Suspicious use of SetWindowsHookEx
PID:6072 -
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe"C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe" -q -burn.elevated BurnPipe.{29F23F8A-8E4F-4640-8957-1AF96C5352E4} {EDA08296-829E-464F-9AE0-FD2A95E97A56} 60724⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:256
-
-
-
-
C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe" /uninstall2⤵
- Suspicious use of SetWindowsHookEx
PID:2232 -
C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe" -burn.filehandle.attached=576 -burn.filehandle.self=592 /uninstall3⤵
- Suspicious use of SetWindowsHookEx
PID:3704 -
C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\windowsdesktop-runtime-7.0.16-win-x64.exe" -q -burn.elevated BurnPipe.{2C3C2543-58CE-45FD-83D4-F0B5DDE4ABEC} {D198E76C-9AC1-48E8-AB8A-7F5045DAE0E2} 37044⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5308
-
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --uninstall --system-level2⤵
- Modifies Installed Components in the registry
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff7a3f2ae48,0x7ff7a3f2ae58,0x7ff7a3f2ae683⤵
- Suspicious use of SetWindowsHookEx
PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --uninstall3⤵
- Drops desktop.ini file(s)
- Enumerates system info in registry
PID:1760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa1b43ab58,0x7ffa1b43ab68,0x7ffa1b43ab784⤵PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1712,i,6399997949575146674,9046149393048426454,131072 /prefetch:24⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1712,i,6399997949575146674,9046149393048426454,131072 /prefetch:84⤵PID:5332
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://support.google.com/chrome?p=chrome_uninstall_survey&crversion=110.0.5481.104&os=10.0.220001⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
PID:5416
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5620 -
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding BA7C13BA2D528059288A8639BC24E2B42⤵PID:5456
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 1DCA0E1B5AC0C80133B725F9345799A72⤵PID:1152
-
-
\??\c:\Windows\System32\MsiExec.exec:\Windows\System32\MsiExec.exe -Embedding 417A542BDE26F5C6D9FBECEA6AC039F42⤵PID:5996
-
-
\??\c:\Windows\syswow64\MsiExec.exec:\Windows\syswow64\MsiExec.exe -Embedding 1C653798789483D1088012015C6100002⤵PID:3092
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 104871AA8A780EC47E07A76833F9B1032⤵PID:5496
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9F0B9942DA3831E9A0171CDD56553F542⤵PID:4200
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A674531ADF6F19C1CB7FE9A199D7B9A82⤵PID:3924
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5EA8B0EC4B8E841694FACC47D09794142⤵PID:328
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:5396
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}1⤵PID:6116
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall2⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:244 -
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe" /uninstall -burn.unelevated BurnPipe.{5E0607DA-FE3C-4189-9B1A-05979B1A2E75} {CB5AF9B4-0D65-4E53-9FAC-6D6F0F3B02D9} 2443⤵
- Suspicious use of SetWindowsHookEx
PID:5708
-
-
-
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall2⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5964 -
C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe" /uninstall -burn.unelevated BurnPipe.{59BE8233-758E-42AD-A414-4E8D482C410B} {3CC77C79-8CB8-4F46-9BF7-C70B87B4AB94} 59643⤵
- Suspicious use of SetWindowsHookEx
PID:640
-
-
-
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall2⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3420 -
C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall -burn.unelevated BurnPipe.{EC114113-5A0B-49C2-A3C9-E9E68F18F333} {00323971-9EFA-45D9-9E4C-2BAA3918F65A} 34203⤵
- Suspicious use of SetWindowsHookEx
PID:4292
-
-
-
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall2⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4896 -
C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe"C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\vcredist_x64.exe" /uninstall -burn.unelevated BurnPipe.{3DE99C77-7AE6-4EA1-875C-4294462CF348} {FBA5B931-6556-4322-8716-C27322D1577D} 48963⤵
- Suspicious use of SetWindowsHookEx
PID:5828
-
-
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" /uninstall2⤵
- Suspicious use of SetWindowsHookEx
PID:5376 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=608 /uninstall3⤵
- Suspicious use of SetWindowsHookEx
PID:1004 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4D2744A8-1073-475B-B6D7-E689D49355A4} {FF1E7340-60AE-41BF-A13F-ACB7517B8C85} 10044⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:6068
-
-
-
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" /uninstall2⤵
- Suspicious use of SetWindowsHookEx
PID:476 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=576 -burn.filehandle.self=592 /uninstall3⤵
- Suspicious use of SetWindowsHookEx
PID:2524 -
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E0EA3724-A871-4508-9899-F40AD291847B} {6D8D5B45-5FAF-461E-9840-2357FDB8F0DC} 25244⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3476
-
-
-
-
C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe"C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" /uninstall2⤵
- Suspicious use of SetWindowsHookEx
PID:1928 -
C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe"C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 /uninstall3⤵
- Suspicious use of SetWindowsHookEx
PID:716 -
C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe"C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe" -q -burn.elevated BurnPipe.{62DDF23B-6237-4A9A-BB6E-1D23A08EB0A4} {1A5C64EC-D3FE-4174-A4BC-ED839533C912} 7164⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4044
-
-
-
-
C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files (x86)\Mozilla Maintenance Service\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476 -
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" uninstall3⤵
- Suspicious use of SetWindowsHookEx
PID:768
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:1016
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:128 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="128.0.178665761\1882276622" -parentBuildID 20230214051806 -prefsHandle 1808 -prefMapHandle 1412 -prefsLen 22026 -prefMapSize 235216 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cfe89915-b381-4a90-94d7-7d06a8203b74} 128 "\\.\pipe\gecko-crash-server-pipe.128" 1908 1e922c34f58 gpu3⤵PID:5016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="128.1.1056720905\149326153" -parentBuildID 20230214051806 -prefsHandle 2208 -prefMapHandle 2204 -prefsLen 22026 -prefMapSize 235216 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f082c068-92a8-46bb-95f1-9d4f612803cc} 128 "\\.\pipe\gecko-crash-server-pipe.128" 2220 1e90f08ae58 socket3⤵
- Checks processor information in registry
PID:3032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="128.2.1778583615\1687375403" -childID 1 -isForBrowser -prefsHandle 3168 -prefMapHandle 3164 -prefsLen 22421 -prefMapSize 235216 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0ea27c4-c033-49b1-bf31-c902ccf18305} 128 "\\.\pipe\gecko-crash-server-pipe.128" 3180 1e922cc9658 tab3⤵PID:6072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="128.3.252756966\1954566229" -childID 2 -isForBrowser -prefsHandle 3620 -prefMapHandle 3616 -prefsLen 27104 -prefMapSize 235216 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9056f73-0625-4276-aa06-6c3f14b4ac60} 128 "\\.\pipe\gecko-crash-server-pipe.128" 2920 1e928453c58 tab3⤵PID:2648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="128.4.2043392090\70401972" -childID 3 -isForBrowser -prefsHandle 5048 -prefMapHandle 5044 -prefsLen 27995 -prefMapSize 235216 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {310c7447-fc5f-4ad9-a99d-f59bd04a2e37} 128 "\\.\pipe\gecko-crash-server-pipe.128" 5060 1e92b03f258 tab3⤵PID:3516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="128.5.192474921\1425732975" -childID 4 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 27995 -prefMapSize 235216 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8ba4f74-9c34-4227-8118-d4fc6a47f147} 128 "\\.\pipe\gecko-crash-server-pipe.128" 5188 1e92b03f858 tab3⤵PID:5852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="128.6.796436311\1951954740" -childID 5 -isForBrowser -prefsHandle 5388 -prefMapHandle 5392 -prefsLen 27995 -prefMapSize 235216 -jsInitHandle 1356 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cadb99ae-fb40-45cd-8392-e5f3f3d18090} 128 "\\.\pipe\gecko-crash-server-pipe.128" 5380 1e92b040a58 tab3⤵PID:5904
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵PID:1588
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:756
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.OneDriveSync_8wekyb3d8bbwe1⤵PID:408
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5708
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3164
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5764 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2176
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2232
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5016 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2040
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6100 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2844
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5132
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6104 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5352
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4288 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4652
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4612 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5748
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5332
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3160
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3352
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2336
-
-
C:\Users\Admin\Desktop\Setup\Setup.exe"C:\Users\Admin\Desktop\Setup\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4296
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1072 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:6040
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4252
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1796
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3428 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5952
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2476 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5764
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:6140
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4008
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1416
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4236
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:196
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:476 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5052
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4100 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4304
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4812
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4436
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1860 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4848
-
-
C:\Users\Admin\Desktop\Codex\Codex.exe"C:\Users\Admin\Desktop\Codex\Codex.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5904
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:3236
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\taskschd.msc"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5476
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Event Triggered Execution
1Change Default File Association
1Defense Evasion
Modify Registry
6Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5f9c97a5362293aff0aa98e59d656e617
SHA1b03291d22791771663f620bd03154b4b81e333bd
SHA256bb27b62a0105665304a6e172eae233585a8a7e52dc202cde7134c178e420b391
SHA5126fa018c5b81c53daa11b416827eef21fdff6bf3efa9581b92a8e4e697bb3aeb4d106b4e3c981f134f7dfe639a32c177e28ce8d5b9972e8e40a5583d184ecdc53
-
Filesize
2KB
MD51e9977dad15a355ac8eb5f8cee63e1ab
SHA1b7a0ef6af48c9273129be8c0a551ad83a444ea43
SHA25697d5c18d1b01506b83d2605f6ffed42ea264536e93f2ea45cc3aca8ce5961cde
SHA51222a1d47a8fc3eaf82e06a7be6dc39ea981973407f105e1c155d80cb1da3b63f88e61960e03be9516e38e747e17b5e6a7d860cfa94fce5f82b5df4ca5a5b19dd2
-
Filesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
Filesize
105KB
MD5bb4588d0f4b324164055e961daff7b95
SHA1a6e76911dafb05846faaa720633953fd40b19ff1
SHA2567c58154115f6195c91f41e1fcfdf2541c87bb54f91ab15902bfd19dde29c027f
SHA512ac067c7465ba5125500d9f3e2daa09e4ecf5d1c774d34b7b61e080a66e60f9ad8d7652552cdbc19dc236f78d6c95a12d8a3aef32954dc19349aa3c66423b3681
-
Filesize
8KB
MD585309a34fd1e8301a89f91bb9252e16a
SHA14b36afcac4548a67d3c2c838ed73f6258e8ae9ae
SHA256ea346650b9314e43a86f62ef292b1d8ce2d527a5258743bbf85ded7ffc97099f
SHA5126a264be5805771456f38402a3e3fd63f8f3e8101750ed4acfeaf940dd4a69441bb381affe8cf51bb8df3dc21524b6de2d07f4da4032ce201dc0694d97d4e3c51
-
Filesize
117KB
MD568bb228df18643a971de2565d52d906a
SHA120246015d49b11ba708a0d4f0781166fc0a7bdbe
SHA256d4f958cb4a9911f20f0b3f4c2696a351c2b9f1235a645cb8982d099a1d561944
SHA512584075fb5f5688aabe5ea992dcfa296e62c23059ceb1bcd604694a254b17823a3f8ab940f4075a6b0410242b2fd2becc3974cd3ea56e4d3dcf5074cf827d8e01
-
Filesize
2.6MB
MD590b594eeba28b12cea496e35454ea7b2
SHA1f3c49ed1f2fb7bff6bae09a204b5bcc2d59e0b99
SHA256a0fb4ec6cec6c2218dd110e8bc46f2adb67d3a59c01f89fde76fa91d263fab0a
SHA512babcd38e08419cc27d8cb8b4f48ced939a3eab23ceaa258ffc3a750306a09fb8cbe99759277441b4c967083bdb7ce4875e0e25452911d54dea328fa8ae4a8f15
-
Filesize
446KB
MD5745897fc2816625a0e5f1ac0f9af16a2
SHA1cfa9d4dbd1a5bc728ed712cef8b3fadc903d111b
SHA2565512cabd57b6e1fbd2b96c298d804a3795cd317f61e154aedb335f6c119eaf62
SHA5127053e9c95b943a30006065a66830bfeb0f37dfb185fcc27019c205e3cea358a0f71ff8007cb6aa39bf61e3406e989ac8366226d83dea5e37c429a5242d1786d2
-
Filesize
850B
MD5485f3cd5a94355f8e6b0aa101abd9f04
SHA1a91650f4f103fdf08c8c261cdb1746aca658229e
SHA256ecb94457c6327a56138dee83fcd82e61352c45e7097309a2effc694e5e78d1e8
SHA51231b1746d7491d4be907bfe966cecc43f9fac099f897f423cf0b85bef4846a325d209ab64408edfbbd110ca3d3d61644d0cd547e431ae6e6ccd5a74cd9dcaa794
-
Filesize
11KB
MD57e23e2abf1e03fd0d3c0ed71d3e67201
SHA177e9ff622eb2b07d4eb908146251d2061895fd47
SHA256588aa09f39b70d191b92c2414217429a2fd21c4fb7c3f21fa1d57ece2f552209
SHA51214496dcaaccd6b00b156d26691465f6fb85da94b04d0a804ad22a8f42d992ef201c4c92b87e2c9d6e5b80ffe53049ed8b44d67ec304bd604d18f6204590c7bb3
-
Filesize
850B
MD557626036538c8abbf5bc761c8ecbb274
SHA1f3dc829a302cd7e268b566eff47b9c5b3badc33c
SHA256aeb0afc185056f716552564e277ef8a6740a4e7f1600032153eebffae18b3ed2
SHA5122d508dc1d441187d18502f3d470a27cc8a34af5b16a97db713a2c34801ad65eaf4e15e7b13fb216c11ef4ce505e438e4dd49c326e8217341735ecfbedbdcd330
-
Filesize
11KB
MD5642d05fef3999b47e67a3b979395d87d
SHA10806dda798421528f8e61e81ac4aadd20cc101e7
SHA25653bb64373a30ee2b7b2d2fca25f1d0047fee7d932f351d902041b3d5fad6016b
SHA5127f362c47552e0e31c1361f5cd81c94a7e3b1755b4c336b36275a4f42b77ddc775ad5c46e5aed5659f10beef92f228d52882b1fc421bba093373df82f110e2b2e
-
Filesize
850B
MD5fd580865ff5b65ffeead3da78f9d244b
SHA1f26c08181b87d1a6979f97293413d25f6f2862e3
SHA2565256b74f3447a7fdbaab2ebe6442160dd617fb10800fd0045895b280f603604a
SHA5125c7dd9a96db711627e4e2f0bc57bc56a1ebd22d8063cc6b8d5d10ad86104b0aaef52fc17e84ebd07d902d345931aeb33e8ba1dfc334e8da251b538e5e8fb10bd
-
Filesize
11KB
MD51c213c5e8828353641cef6d74ee6838d
SHA16e16eb31f642327afbed7b8d4ca56e791b799cca
SHA256a1cbfc3eca8b075ce204c629bf0cf36b0add593c8a28040018319e5e2533ffdd
SHA5127b7a222c49a95cea34d8ea005302295572a9955a396bfb51e929a83fd351a67c55c4b8c1647eeb0d4d7bf5e9b0c9502d7f4f4e75970e5b004bb72b4c5c2abf43
-
Filesize
62KB
MD5b4c6016286bdce7c51c3634999f2ea5e
SHA1c446378afc6b12c372bf4dbf33efa61e9f7fbbda
SHA256a8f8ab6c63c8d4471d158010f18cb24d4d2ccea495a160cdcef95a96183ffc6a
SHA512a121b4df2348ef53413b82c69a66ad3654aaec7d40011dfa4968f9a6b9a5e1252089f39f4961f2305a678c227abc14bac88a3674ab960fc52f71f7c3776c928d
-
Filesize
880B
MD5dcc6434e76ccc91fa6c35df0d0d6f5ce
SHA1ed1d50016a7db340208145d988a82ce7c126cc94
SHA25645526926c328fd96d9be162238b22694fc496d7a946c0e5a085b83257e7e25e8
SHA51290e08c83dfc95cac80150ebda86085ed2dc86fbc1b2f1112de15638f548e2eb4fc954e3ecc17d828a1a6ed549acde8a1f8ded666865d46ef30eb026127c8b102
-
Filesize
11KB
MD52317370717a6bf28b9af805dc45ae5c4
SHA1ae6876ee8672be7ef18ea64af2293e0d4bf8703a
SHA25601cd704e1fb542c10b368985c57204b1f78f1d61b07ae6cb193b47aab12cf663
SHA5125257384b0e7d49852786f81b03d5cbf4026705c1ddf0c533faac970d92cc9e7b9f3a954bde5eefda6c883bbaeb7feda50292245fed9fd1e5914a404d66357ec4
-
Filesize
880B
MD5f35d405459f10fd3d1f52f6dd64252ca
SHA15f3bf4ab1c25ec54e79afe7f92390a624ae5cf14
SHA256384f7c7d81020a72029972324ec6d8b84dbb3f342418c15e0833db02174416c7
SHA5122bf358ed9e7c09f49280bffb7e200d93ecd3de99d0a842bdbb468b808383aa16f444ad8888f030d1bad5e00fd49c7c3d01a72a256c96aadcab04dba59fbe0a7e
-
Filesize
11KB
MD53e3b6511ef707e9d2344b320407ca1da
SHA1af55e484ad47daeeaedc5efc0d301ed8d6a7be16
SHA2568b8be00e22af7c415c0086e48c6ce86ec5d146c75a43829ead4a82d25b5ff636
SHA512a14250cf607d8d3bde7b9f118bdebcda8deb1b4866042be3aa4d266fcc4734f47f2398c6635d4884d16935c58df6e3a64c68a6196e9892c0c6e2195904cedb30
-
Filesize
880B
MD55fe646e5f52a6183027c87160b922e2b
SHA153123095d2ff679db51a55961e7efa6f3c2cd09f
SHA256ff729c37c44b93705b3d7f3e07a35e1debb5deb6be7a00c0a82546d0fb88c0e0
SHA512a8e7b4f06fd7a2f46d75ba2a43e924aec6d6e270a0ab7b6a3f6cb259d33f7ac78b00ecc6d6b39e8f0433dd35894972790c43d81c7177bfd72decff8a4a768ea7
-
Filesize
11KB
MD59473054628d25757f804cc2584a931ac
SHA11ec0e971be84d5e980988c16e1dba3b5323e7ca9
SHA2566c699e95e7a018673fe586f5b96ead5bff5861f22699049d72d92ecb53497a47
SHA512668ac3365f98ea2c6ba58d13017dd4a2f8ae28dc4bd8e8d72ee6fcfc3a7b51bf0b3f658e8a95c6f5bd2015000f3a347ca417915d99ca4fb7f4a98271a27ad1ae
-
Filesize
13KB
MD5d80746b2f94a3a28e380735d4b8a9ea3
SHA1adf85a8d951e2ef30100f88bd072d333839462ad
SHA25645bdf89c40a35f2bb5e8a49a8fe3b67a9984adb4f65bc40ebf4e320c50194218
SHA512cfc016d2f98385f407d660e276e31891939792d7de667dc8fe0faff37e38fa7f02b55526084682c75d474757c2dd790b714ac2fe1300f39f54fea61b4b3780d1
-
Filesize
7.6MB
MD55440ee9cd44616d60cde57ebdb286e95
SHA1bb7635d6911311b2f3a637a2e9d8446fd0698678
SHA256e3ba35c5572761c20eb59e25b2332a0cdfb726c48963d40291d7f977531e47a3
SHA5124600215bd9788b30aa5a5038d6749aa294ca0d6d0063335979d2f4acc29af09967a9160bfd8a2ae093f7fcb95c80fd51ce832cb639354360965d0202a044e1a0
-
Filesize
4KB
MD5aaa2e20588e154a10747bf1b31b55125
SHA103cf9f79b9cacda13aeb644a88180222240b6f0c
SHA256fd12cbad7d1155b311d97dd5da05869200c50e7698ce997cb96004f18018ad2e
SHA51229df908a09bfd551c50a3c64074c88814065b5b4cdc0d8a1fda5b1d01cb1f1597f2b71b343b59b9fe99ec7123fe48f9a83f93c0880275c19969523a8bd56dcaa
-
Filesize
108KB
MD57ecb661f50f34a941a44dac7241f7d08
SHA1772b0df3ad4a89a078cd4ff8e5f45115778d04a2
SHA256e2386b60a73fa7c95a8968161fb1c84dd9143462b2880133778a3027f75730f2
SHA512aa007a71da51b145a7fc702a0cd8930d43e03a884c331afb48de01e82e06c20d2a5325aaa893d03a25e5b670e9e0a03f002b55d9620202b6b48045e4a79b577b
-
Filesize
16KB
MD5e1eeb7e26ab04075eecc7275239b20b3
SHA1ba62b37d4233b88948fdc2ffed08f3c82e8627f1
SHA256d6cdf961c6d2712fe1958815e51a30960d79fff1e97788b7741627dba972e8f7
SHA512dd64909c983794c8ac6c33b74711a89b3b33e4429bb5a3a2a2b4e38f5d74902b1589a97014a35fbaf97b469fa57a11314c02d68e1db0934de5244308699fc262
-
Filesize
4KB
MD5f8d11c60b70acd2ec9154ee676f615ba
SHA1a869fc75f44438d9207511dc73bae976f558ba6e
SHA256b342088c8a4403092703bf40062041265e12edd204aff4f6532226478a65cbb2
SHA512c4c324e22ff7570c6d9a6fcd5ea3bfc4917a404110b3e202be847355c57c189096feb5c37c0a36c541f4a9d9e80bb1f1bc5db3f4146e515ba34468c5547ba907
-
Filesize
78KB
MD55f0934c524364c1e1a77db8ccb832c5e
SHA1848eec26bf024a7c350bdb02d0e92116a4882b76
SHA25682589b2d5ecae5ddcda39076a33180b6cddb7f54a0cffd4329087eb1f507bed6
SHA5121ac672272b16a6bfd3977886fb773a21d8606a873478ff036a462728d18b59e9c68a08606e1f869b7e6606416b74c90c72ff9be33036371282564b0d3723a222
-
Filesize
908B
MD50ed609c8782c37c67a5ca7233f08d103
SHA1c286345aae83608005c0e20aa000acdbfabbdac8
SHA25610913008d1befd194fc4c96cf0ea20112e9e075974ff5420557141b7ffd5198f
SHA51292d4547b36cf76823bd9658cc8476afa33f1b20425fae2bd05ea353b6d4de6929c5b72f10100aa1b11493c177df0526aefd1e7d3fabc10d848b88d9f0a382d9c
-
Filesize
11KB
MD5524014d39a54d3908de59807c09cae3b
SHA1cc166f76626f94cdbabd8095286a82a474af9f8e
SHA256f259988c45f54338d57175fcf4fb9f895d484a4eb0c4b861a3abe885c263be66
SHA51202bdff78beab753a58f46579e61ad4d2953475edb53b57f75ed4828ff04d9641f114357f11059ae28d82c1d28f7433a4eea7b7cc01c1fcf85bb5dc6d58261182
-
Filesize
908B
MD5d2bc82e2f203cc4778ff312475a1d37a
SHA12da7e8f3e8e4189acf5624bead6b7b983af17e5e
SHA256e34e79770b6a3a4ad1583c9a90ac12aa4348ad134366c0b0436f00162fa41734
SHA512976b018f717e45136be48ee8b4ba2593f88e5ca3c6d14602621d2a394d13bbbd6e707ee3a611442caadc3f5f1ac1a8de87b0407da8178a74d25404cee3d9657b
-
Filesize
11KB
MD5c1e58c73d935540d0673dffb303aca5b
SHA12a95a12c512a2aaf29587db1ec4271cb92846bed
SHA2563d004ae76cdc99ece59a0dfb980182a727635459eefb4590d8e2c80ac3115b44
SHA512471b7f432369940d1854dfe50a71e06df25550704efc4f83c60815bc017dc19f875e2ee3733a9750de4e79c6413db59e762df42777b945d0bc045893604b23c3
-
Filesize
224KB
MD5fda48714f6a291e25a1a219e89d59d9b
SHA1c1e8ddfc64995c0acc48623f30aadb1448bca62f
SHA256be2885e897470da3778a661158dc21f32a4aada769996abda082cc4bb6030086
SHA5128508ee381bfc5d2491fdd9b14603003264441222984762d14f06440afbc2cc88d80b95bdbbec4089127ec76402408a60b850e1f46ebb5bcda5aa3ef1b6ce70ab
-
Filesize
1.6MB
MD5574d91266ee9fa03432cf50da30dd232
SHA1b5c48a695fc376c174a79954a6d49280178eb4ae
SHA2566f262bba82eed8a8d69fac44e491b99cca2d4cd448166291ce2186833e730a85
SHA512f052ec088a703e50c893decd7f88c0af2b36251dfc70b08e513d55964d1be299f0d772d52e71bf0aeb9abb752eda156767b8be321320e1c60f78af285b33aeaa
-
Filesize
898B
MD5846e77a9f3c6bb2ecf5518d470b2b908
SHA1f16c73c5b7a4b0a596ab41472a246faffd9a9b01
SHA25617a9b9222850ce3e6786cedd7c698aa145453b37cf8f03d676fbd89f70afa072
SHA512d94115b82c4abb4570a821919458fb2f322d939928fba6f00fedf139f489f358004de4db3b58b4fce05afcaabf7fcfe9e51c3cb7d0f6f43bebc56c2094086941
-
Filesize
11KB
MD5224d8b3ed1cc4f5b32e295612f1c263d
SHA1d84f00249e43dcf21d4e68c1b2b21efed5f3c267
SHA25620e49d3119901517f055950021e922971cc65578c4ea2898593e29becafd2676
SHA51287f9a1d17331e85a3df58fcd92e65a60f7b1a74eeac6c6707aea56fe7dde578f1b09798dc3f7a7c0a4b65696524793d7121b19d27902ecfc215a3233128dccd2
-
Filesize
898B
MD5ec5a78ba8d91e89c0d9b3683d0cfd5d8
SHA10db33de0721fda2e302c39b98f3987ddb9267850
SHA256b3d09766f50b21e4b825d1ec7908cadc7fd74625b4757dc7952344797c72ac07
SHA512c8ed1321211aa260ad8fa7314cc4036a743c0bc1ac06defc9d061edd4c3032f1e42c6cb06f2fa8836e66a0a4816a921961a5379b0e20ced8fd4f398085b125d9
-
Filesize
11KB
MD57273fe5d0ce6473e646ba240e3fffc8e
SHA1af11a7b48bde2b1046779147c84d3287a469639f
SHA256d4e738f4e3d39e7001830f71b52836a20707d14269cba22f34f3fdf0436981dd
SHA5129efc625c42ce99028297b23c78226264c851d74d84158c2221c2ff9faffd37248a3977461e9fc021e25b903bbc11ec475178157bf9fae9512bfe39eb98404a6b
-
Filesize
898B
MD52408534b8cefaf5362700e8afedf070d
SHA1f197be5f143eae025a5c40837b8432e89b8752a3
SHA256e89e45dabc6a2422cd5f523d554d6314cf9ecec2238e26c6d8f63f040ed9b6c2
SHA51294b78d6d0b597fe9b69d438f4ac3d0855ccc9c684a28070bb9e2cc44d171b5047b8c3da03406a05405c74ab56081dffbfe84478064b0b0884bfb6e415c3159fb
-
Filesize
11KB
MD56d525c5be39dd69154fb0cf297fa9c1b
SHA148b89a8803b7020d7a0bc5dd760c261b2dbb87bf
SHA25682a7761c6042176cf97947da1e910ce8a320fa7a17dadee2a115ac5f34cdc744
SHA5120a0416c8a7f967ea869ffe2fe77535cdfc9211d78fbff89e58cac0a4cbc38ba182fb3e88f4de3d38c010f6222ba52f8f10e3f58b4d13e5c7438f9a81a8f871ef
-
Filesize
366KB
MD5d78266c35a0ed4bb6fb2f6683c8a6e68
SHA17ebda40cdb602b20323e6e7d24f28f25a931b11f
SHA256c68b82408df6d0e6f7c7ca0a5e7d1c80af6cbec57788570bea58efff8053f306
SHA512e60ae6b2cd22614be134d06ce823bc5d31d0aaf1f01dcc4fd0f6021bd307609e8d2f47ebf8490d3bc33f0b225303b63e44f09384bc3804494f595e876e673854
-
Filesize
146KB
MD5e8013aaa8fea097b88d7021039154ed9
SHA14866c788df4739c011e62f3634989e8959832730
SHA256a3334e83a418db4f304a621c2a498db48c0f8fe21f21282cc61e5ee9b80c1370
SHA5128614a03a87b2c06d1d2e577def16deea927e010d0f269f37613b9b737edf72350a5457b22a82d96ffd6d02747bf70116be301f891a0b103214ea3a8263cce32d
-
Filesize
898B
MD54da7266720463186401b1ee9ae625e09
SHA1040cf60bc1f52402d10e0b898e38b907dd9d9ba0
SHA2562ec5d00d46355af4cd7d06a00745e726b87c329d090e0acc02f767e75c60601b
SHA512da22f8e24f5d59232adf9e77914d65a82ec2bb1331a83f72c2d45f8e6e27de3bf113173ba56bcfa40e95851f105bfd941cf63392bd6d4fd4a9b1eba36087c091
-
Filesize
11KB
MD591d3ae6b71705330e73ca4159817ff4e
SHA1a941037aa373a426e73dfb853526f150ce4457b0
SHA2564d16c2bc77cc45c596dabbccf24e51b8d6b47c6582d540993856337d9c7dd6ea
SHA5128866140622e9241bbc2a5f7f26f659b7d2dcae7890c6ad357f76afeb5b96e6b30914b2b223906cd1f2b29eea27e885e33774782cd2c3b688aa1da72ee61a56f5
-
Filesize
898B
MD5de2943783e864e16eb161a507dedcd3c
SHA1577774c71730c72d22a80e5d049073fc23f8023a
SHA2566aa7490ae4134caf546322c9aafdf062082536e1b4c8ed063c8bb5f93cab8afe
SHA51200abc7a380a864e808e2b0de3dfa5555b0bc691b0d8153bcf24935495b21722be21f9143edc67c7a0fe69f9e3d1e6ebb3fedd633efe439e6b58c1b5594c051ec
-
Filesize
11KB
MD5da8a2cab1ddbd3fa6cfa43c0bff54348
SHA145268d28d4e628781f65f08612394ff7e0d38720
SHA256a19e7736666470a6eda6d00473cba753deb0e8fb40d3311daf3c50676040e200
SHA51218be388c509985137e34d4ccac72e60dd726f9c64b76e25988b7c91b3a306f1d15b21546face19ca087db02b0949306a554a889e3832a39c83f5f3686dbb5b10
-
Filesize
898B
MD55062f0598bc909a99bd21ff77d3421eb
SHA14917cf83d7e3ebac3fbf3e405c4dd633430cb98f
SHA256e2e634f5552e5214c79cdc2a33672f2cefda7c73fb6d9c7b87916130a969c4b8
SHA512ed1d812cdf867b963d0a9bebdb6d63698bb107409920ccdb770e197815f5d72b35cc8c1e3602d4b5c63adf06c0d9e125c5a5ad6eff2da22df373b06c7c88be2a
-
Filesize
11KB
MD54667b1d3fe384b97a94deb1553af2174
SHA1e14902922748fffc1f65cb299b52c114887b761c
SHA256705b42f6a55a4cecd347ba954089148572ba9fa033e5a08dba176b652488457d
SHA5123f2db08d7fbf8f6042f7ff1001f20df3879402a25e7d3b8bb7270ad3be7216ac07a8ded7cd62568d6292bcf3828286105e1d9b87f21dc3e1764d0bc20985a8bb
-
Filesize
54KB
MD54f94bf5157da351f7d0089a0b72b1ad9
SHA1c61d8fb8801a3362fcb8eb539003c996cd94e9fd
SHA256257b042bbab38406cb720fb9b2275828b003c6be15933227ceac68e08b846412
SHA512f75d0365f67ff6632c8d1a3745e8e8eab55b25a562841910320dfda967a5428a5afc469a211e90d7ac78930fd55e0597b11aaf15cec5e57c0f22c02da53881d5
-
Filesize
16KB
MD5df0c6bb7965a3dfce5f0f158e9d5251f
SHA15250b2c7d557a71dc9fb0823fdc0cc94f0a81e35
SHA256883e42e3319fa4c059623e4d5a937215ad2f2cb123e88aaec27955f258627c4f
SHA5128b5f7cfb9d3d857b2396706cbcda445b9131abf79e84296ecbbffff0dc1588b19399b506e4e3110ac4782f60ddee081cd5243e598e0871738803512358efee04
-
Filesize
902B
MD50da2f7810a668012c630db3fa8230499
SHA19ca963ea4e3544609741308d71863bc86a0c0ceb
SHA2564d997a3892a9fcee4bedb3f47b91f068d6ac823c5ee5f00d1887634e438f41c0
SHA51257e214fa9ea204094bed5086d6542a32774b3f234edd93d6f9eb364cb7a0825b2056bf2a299c65f8395545fe7f5e21869525575dbfa3c0b35c796f8de6c543ee
-
Filesize
11KB
MD515caac1ec79f05d8aa62aaeec6903e8d
SHA11990604b5491cc83a73f592d1e70b41be5a2d998
SHA256e485f4d3468410e989c147c9abeef742c57650a794e0ff18c2902eb976d25cc2
SHA512d418191828c8fca0a4d092d2101191fa5afdeff417cc4c9f1ba02795e3e4981a3ea3b0478c6abc00e284f95c5529a686411b90870569bfcbca15fba61372d402
-
Filesize
390KB
MD52cf01239384af6de8b712278d7598e90
SHA1613cb264d8628008809878154f6eb17f35031c04
SHA25651a234186dd5e1087a7ecb79bb8538767bd4bf46c645e1a6e83f972de726e95e
SHA5120e2dc0cf2d2925895af2e5fb918f0c171bcabc6dfb8c094dd63ff7df535f776ff2c3ab89038ca5bbff0f4c02d8474055adfe3609c70d97870c46504f7bb871e6
-
Filesize
908B
MD5a9762e02d260a34b79fdea198f3e82d6
SHA15023fc4a74ce1eb15893cf0f724e658c9c5236eb
SHA25615cb74f02499b76c42faf72e6364392bfa997d0b2668016bec69dbd7d0571578
SHA51261aba378b6a2533b9f67b4f46a2873fb08be4fe55c0de18785cd1720f4041aaf003ab0310a1d7415d8153508789ceaa82fd1b0731827f75aab41c5962c905502
-
Filesize
11KB
MD5af6ae18e360ffca6c0ceaeeebbf6d8d4
SHA10b4ee1121e9070e95147f6c1664f23a9c772ac7a
SHA2569ae57781418fef37b51dcbeabd4e26dd82a35c3aa2c15917cb98656889d3c7f3
SHA512eee57abce64bd9b1514a5a3a074948547725e78aba19e085b53d9e8156613a1ee30e60fef77429844ec4abd22ef02c45fe9f31aebff0eb7925e0a62e2b4efad0
-
Filesize
908B
MD597cf058f86fa06f7e5893211dca28a42
SHA117bc3e8fdc48c24ca60d7b1ca10acdbfbd8b5e9f
SHA256742530e55d505236eae91ac26a923b2efa8b454fc0b449ba43f1d6a28ac5b52e
SHA51284df980720e846a8a3651d62f2639108818d18db139c6e0b41acb0ef4642312e11689bb6971ef778c1638d8d53430571eb8d560061e6e8c0cc13c1f40b35fcbb
-
Filesize
11KB
MD56a5ee23e3d7b67dfc39ce1c085d8c654
SHA16f9c0d88df3df2cf86cc543822b2e6196e849b15
SHA256b40f265fe31c5dec0943b2d910e997ca1840ee290912b814eeab333af71fbd48
SHA5122d0cb3ada34426ec079933c96af4e3e67795cba52a6a78b520b7c7aa02a7e0eff53a33da206c7843df42a257474380b3014338c2063dc8848edbacbc6cadbbc9
-
Filesize
908B
MD59184814c35561939e4b0ad91788441f1
SHA1a5281447d62fb3acb7915e757c68b6c29ae69adb
SHA256788f42981bf0bf25f0899d9e3c19a0d6edea44f9c1f9eb616160de99b82e8d27
SHA512cdd744fa29b63922cb112d645badfe59176bed7a5c2ec12e3e8d095ca2401588565f356aea4a1f40157434fd8d20edbcfc92febc4fc33e4a13a20abcd38ed199
-
Filesize
11KB
MD5acfd9dff068c374658366e397a5695d4
SHA1bbd33c62b022d3592e0c2a67144070ff4e2709a8
SHA256a4d8b8a525271bfa836744b7705f0993ab454d9a153f81b3502cc62d9284dbfc
SHA512b2ca941ee0d18bec576ba84e09403cd8dce41b9017134581f1a2e2babe25dff99e9f172a6e9764ca6c58d5ac679405883640e2b7bd108cc0308336098d9099ae
-
Filesize
19KB
MD5f8354171db5fc4506cd0a0b9a3c9eaf6
SHA1f155f11010d91896161a2818815a1dc32f183731
SHA2566131d4341986952f7343eeb984544a17bb5f121e1b24ad572ae93d928f9179fe
SHA51210aa970372b956ee7d018b4d5d8bd7faedaef20b83ada551e7a260730d5a642c9ea13548743ebd470f5ecbc7a08ddead828c41e229c96538d93d3f0ea7cea52b
-
Filesize
904B
MD5967be7e7a5e3cfc4902a4dcd26eda18a
SHA1f0b364113ccd380a256a3f6217b8795300d0fe30
SHA256071549c2a67ba11cb90362c3a60b904e339c66d33add4e0fdaf348f17365695a
SHA512db437ef46aae9b0f45bd21958397c163f2c55c85bda25215af041023c63531ae3e0b62fec62ba76b70c6a297b928fb7c8a79ce82463ade93d22a6501b756ccda
-
Filesize
11KB
MD5e9e2502356902589e8b0b86314294f30
SHA144a972c0ccbd52ac6e21f2c0cc1dc81907b5e7dd
SHA256c1fb9faa66ac74fd4094538d83afa96c8c3a5bf7f30ec302b7ed1ad1f4d99b25
SHA5127e51bd97735028dd90e855d8e661e2aa8c9e859e2b4c02475d65ba67eab8cd99ce207795e9a6eb4b146483852bd90255feaabc7b50534a7efc43bbfdfdcc2849
-
Filesize
904B
MD58a138a7c5f6826e2adec47162589bdc7
SHA18ba9043cc728827655406126e46950e6a6bf35a1
SHA2569d4041b781a2fe7e677cbbb210497abce1c6e566047fe4592d6b2bd182768c43
SHA512beb99a0c999a2e2b3bee93c32246826608d74c95b4aa1e5993228dc5af9e1a775035f52bacbd488d7589f9821fe17df2652f94bc5b66297963fc3f6062b8e0fe
-
Filesize
11KB
MD5aef35350473c3e263b6d8d4a76616b7d
SHA1265bf8cadf460109a3a2d0d8e23b7b1eb18d7660
SHA256fe61442089ed613075613d0db818e9f1c87907dd5c76dbfa67e93abf7f24e135
SHA512b4f966b9c921364283a6dc42d8b44ec10e8d032089dc157c23ecfda55fbb16f86b9c02cbb22fa0eee51dc784ed83876c9b29ee9cb1cbe823e3b99bf08e46cd76
-
Filesize
904B
MD5a5c7d3197e0ac097600d2901ed4f6e77
SHA1a459c50978c7e377f1130d7779f4a2fa41d0033c
SHA2568d0b449684a977a3d81b8fad0663a20555504e8609c987e84364a6e232b51356
SHA512f9d662be82e96ff035c7aa938a9de7f47162bd4564575eed4aaa42ed4ef49ced0fa4a9b6b2b789b5655c3ac6787f7b3c8439d82962d9668c1d31e62a54a804bc
-
Filesize
11KB
MD58b1132f4e0387a233497141cf30b1edf
SHA12afb866bc5093b1281b2ad0fc4a29bc2cab035d5
SHA25651063c0b520a9ab73aa3a0674c593c3c3de26fa9709175be085d2d8c456ab54f
SHA512f528da8cd45823fadecf870a348f605e8fa199c6bb139c7930392cf638289c794ea15746cb0f4b9d918a1fcfae7c6578261e7c20fced854e9afa20974e252490
-
Filesize
918KB
MD5be6f4fd7365dfa124d60114095380602
SHA166a41958ead9151d7e61d690f12006ca8a40df89
SHA25666d6f247e3cae875c3c86dd16ea1aa3512663b8aa8626984007bf5343326bbaa
SHA512e9f7d819714c905577a2603aa30cc72b87b7a66561c7cc6029dedf48de78fc3db580069602dedbc6b18496217da6b94bbe0c2734ba2dfa5f8b57b7fc6cbdb781
-
Filesize
896B
MD5070f18d93af687edf010efa343dcc983
SHA116858f9fd0d8ed788ec49460ca2b596c193d2af1
SHA25689547b37ec7e20f96e1f1b9aeabbe86cac8a0372bf1520fbc2272eed16f8b4a0
SHA512e7b9ca446b5ebf397e7c220e8a0f639ce20fb35a11010b641f6727ec1c9119093790d4f5521ebb28e8f6de4ed5c4c4f58a27355fb5d012ec949f0de3df5586de
-
Filesize
11KB
MD5a06591a7b689e5fe00f6755a180af130
SHA1a581485fe2c6d9acf795e80c7d6b0f3a0e721584
SHA2566555b4dd2c4e4164c8e00c06f6108a9c1dcdf141a5ca54bbe5675e08750f63b4
SHA512bc0195276fa8c7937c7c39d567a7f41cc4ef92521836515c11ef5b422d68aa791b96fed829900e998435eb5b719c3a21e58c94534ec1fe4d637e39d43407e4ff
-
Filesize
896B
MD59f8ecff52bd15cff2deeb91bd325e101
SHA1c82a0eddc66f95f0bfe1fc984671837cf0b07a65
SHA256aca44b663633d4785d4fca1ed45d2c1d58c994fd927374569b8b5bfcd7079170
SHA512cf52103d480a589e88c909239dacf5add2467adf6f4ad52d89af16ffb9a5cb32d7e771fe005694d37189ab2ecac08cad9ca7cbcc7d971f17d384a959705f168c
-
Filesize
11KB
MD590891a2ac9ef19d26ddfae3dcb69fadc
SHA114af0ba5b5b4ed5dd82685c7e50a544a5c5e7a98
SHA256dde3ccb81cfcc3eb4cc65752fe14bf0c7ffc6814d55f7c9bca4d9ae638b30f6d
SHA5124f97ab143a719bd614a63a3b34bb6ab6931eedf310e2e077c361fd63d2d579e126a3a419256834b021d86250114ecf4c0ef120c9fb267be9aea004b252c17a49
-
Filesize
896B
MD5f1e8d3b056eb17b33d6d23b5dd20eb56
SHA17556e1bf214dca70ffec24768f3c549ab4ab1886
SHA256e709b2b5901d6987b46febd4f3d5ba50b94e4ae4e0a6bde09ec981509b72000c
SHA512914b340a8c175dfed4cdb99bf071e14ab787481517009ad92680725368dd7b7667dfe2ffcfbaa871b2a9edad6b8566828133dccbd0a0c7fb90cbabe4f812da87
-
Filesize
11KB
MD53fd311d5a5cab694d93c6de5ab39adc6
SHA12950e2cecaa45f46dcc443037c7a4db550533578
SHA2564e5cd2074b70b073ff9010a22f6e469fc08c93f63e14c85de93377c2d0e97fe3
SHA512fd884db714d134994c1ef742ee85d5002b07e29b8bf1db2120a4139198f162ad67b093be3f232eeff3e05976ad243ef691af69db86ebcc8e2d6f0400245c6a35
-
Filesize
44KB
MD5bc959a160882b0de0583047b1b5b93a6
SHA178bda837a0fcc25623b54e95f3eff76c3bd79332
SHA256b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e
SHA5127cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd
-
Filesize
41KB
MD591ceea551937cb5da627f33ef7995ee8
SHA14e7483605c4027381e4796345f0a0e6aa9342a5b
SHA2564256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806
SHA5122d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9
-
Filesize
76KB
MD57173d17aa9ff4cda07fbfff21a584a67
SHA137b04626e282aa6ae2a2dc96117dfc5b0b1f25cc
SHA256972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867
SHA512b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167
-
Filesize
35KB
MD5da7787ae5278031ef79441d29599dcff
SHA14e2a4c70035808dd8bffaeb6ded8fe2980566e0f
SHA25606afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39
SHA5122c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e
-
Filesize
35KB
MD586a1d818b679edbe94ab51b963ba79a1
SHA12b9ee6b54aa2f709442e7e514335e2548c933318
SHA256b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa
SHA512ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9
-
Filesize
21KB
MD56083b2909a6c1ab52ce84da1b435e7cf
SHA1e851ccddf1fcb0c2fd9cfb4a357f72633452f240
SHA2560ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956
SHA51253b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1
-
Filesize
24KB
MD5d87310699e3baac5ecc0f64673fe3485
SHA134460b0eb74977b98d9d3e683d5ffa2aec11059c
SHA2564f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb
SHA512096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38
-
Filesize
280KB
MD5a3ae8e892e025e479978fb07fb449784
SHA171a1641ffb0da859af5e355c5bf4a9bcf1746e74
SHA256a991c7d6fd80ce581f8bbeb7268032f06c9434cfa67298b0669c84d38be6535b
SHA512e39d58dc26f8710006fefb51cfe1adb34c8886b6b281a8ea3d87a89c116e255d39c028cc42fce05a8ed61dc0a7c602e344e6c0957bc4156f9a76677687591a54
-
Filesize
108KB
MD51c8e5ef9f86430fbda800e45c0a89aa5
SHA14e18ee249a208dbf7d7b52d412fa0d402fd3ff2a
SHA2566e18c01cb3fd1b795c062a00d2921e8e0eee8efd89fa77d50c5e16f2b7ce74b6
SHA512721f29dfd9beed272cbe213eadaba62aa1e1979828b23a226cb05eec536ac495eb33a01da05de82a23113a6d0ad4012032f453339499db3816abfecdecf19b66
-
Filesize
152KB
MD56742f826c21773c933fc2a68ceecb99b
SHA1dc689d3fb31e7cab6a33cd2192d6114542173514
SHA256a203989e4399f9443a8848486292dcf04d7c7180dc7d1b4af07030cb0532e036
SHA5124138836bf9561104facb88c175d9a1d29863110b7e0108149cc0ff32edddbd30ee1b0ba4b7ee8137ffe36c973aa2901f7c23a3dafc79a26b09a64a8b95b6db9a
-
Filesize
140KB
MD5cad14a2ced4a556139097c1f716eae70
SHA19552115b645c17165bacc2231725b3f8073105a3
SHA25635cd20b4567788e3229be61becd6ea1eb115a2b81bfacf3d65d81d0003ecb96a
SHA512df629a07c217880f174d52772090d49a5e88b73c0df45fccb714cd6ac4c01612e0aa755a1a0b9ba6c2a7a6701e6e94653e71a54c97a1076b7a5bde99d7f0c331
-
Filesize
189KB
MD51f50737bb92b1f71b15824a0f113d3f9
SHA14d78793ea921986d011a024b91ac59d6c02de6e0
SHA256f48f267a6e081809bd5ae607aa649529849a6541ca303a5653f6515d865a6b57
SHA51289e6be6df11dd02896382a7cc9ee41ce74d5bbf845722531ff9a26fd2cb1a016925ea7d4948a4a652c079dafd084538b9b74c4a5dc0bfdd3cb2f0293796481f4
-
Filesize
76KB
MD5d68368708be2b6dac797743e23dbf655
SHA1e843b858d72359ecf6fcdfca328ed19a7f23210b
SHA256dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361
SHA5122542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e
-
Filesize
428KB
MD59e877ffed2e2c9a013c59581f88786b5
SHA1d3bbb3e2c36520ec267463916d3356bf4fcd8037
SHA25613f36534cf603cd722ac9078e51930cba190395d23d6688b65a8c788262759e5
SHA5125b4ff6de141bf2dc321dfa05fe8c93f64ca91eae6b41041264736c3c6db9d0520c135103873c5f32a47c742fb51317b3303e7656cd259331113f9b876ad17613
-
Filesize
292KB
MD5bc9a83d77cae33f9eb9bd538ab65b2a1
SHA1363fe5bb344cf1843d5f7eb2b0a725ac491ad6d8
SHA256d0b2520c660959e388b3b24b1ebb7a6eca25dde878b0c0ce798657ae422a9c3c
SHA51237ac66723c5bb78e45df3ae7175b497353343aec2eb5412213e3c6a1f3558e9cd68479728644643faac97c34ec3f3c43b7d01bb36b1e406613cb46ae4cef1c57
-
Filesize
128KB
MD5c7fc5f01de9577403a1ea8aafad79e72
SHA16422fa355184394ace02c0ba88e5b8af3db7fa6c
SHA256c778577e39211753844d5fcd2267464c043cea271c1477e866d40c9cbdbe49ef
SHA512b7af7af4aa1dbe92000722bad422af6d54c842af065427e1cf82f61b1a0f82e71f2a2c9b4b12d1642205dc54ca23ecd4ac61c8015076389907914b0cecd04e87
-
Filesize
92KB
MD5535d9d8441e0e22aa3f407c7197f8a0f
SHA1ec6d047e975c107a7ecdf78bf352a5a68f53392f
SHA2566e6afa2d6e7c46b9c64406efaf23bfdd3f7fd7a25cb757580f70730f4096ddb5
SHA512f5e051ef6af191d86797a55dcd114ae920f8a285191f3f09c3493497d381f9ec70921d712c93280b3c8e82fefa77c040cf51e8af3a1e52b040a7fd442d9ee95e
-
Filesize
356KB
MD55e1a793d9615d4d9e153ee416abc83ad
SHA127d231f4d1e2b473f9695daa21b22804db779826
SHA2568186f5e641a5b0770b635814b5cec2a5dff43158918bc1174edb328194b27090
SHA512f54e786f2fab5324ce87be1d84ae69f63afa4ff5399e00248451375d2a56b5a0d30c74b27e5fd56b06976ec62688b09dfa39c4a1a02d47c3aa92da21b5e95876
-
Filesize
352KB
MD503898441f5d9a8809c04fe746fd498b3
SHA135cfba8e3600bd0a3389e96dd56ecd8efbf5ffc6
SHA2568da3b816828229f66334565432f12973529f0d594b685c919b753cf2f692b296
SHA512dc2c0f6c8d4985770535962ad31e55c13abe248363c12cf55a14bf1fe9dbbb78a2c91eefd9a4711beb53606202b1c2d5648971339c4edb9a61dd271b61416b12
-
Filesize
82KB
MD5f148286b321ed09c2d17e9e3637c807b
SHA1b0928429f52028b512dad9c7e0996ee7ade315d3
SHA25633fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a
SHA512d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b
-
Filesize
41KB
MD5e3c8239a97601bb203b9e9037eed89c2
SHA175f0e5f417477d4c491e8ad81f498faf761618a1
SHA25627864727360196540664a55e1808db79f07303949156f843f0520106ebe047db
SHA51271304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2
-
Filesize
76KB
MD5219c69df0c23fdaf84e4c9ea2835a628
SHA1d3b091bfcaa8506d299cb1d7453fdce7fb27dafe
SHA256e9cb0016e439bab9d34038b15798cd9261640dec8c577a0035314de5d7892457
SHA512e209df73a2dccfbc349657925ba9760dc2ea9b52e696f5159bbf3c729e768ebf43a1e6e86a28bf6b023dfc78fd217f03648513479956bfffcd4da04d1cadf8e8
-
Filesize
80KB
MD575e8bc00ad7da1e7628f146dc33cc83a
SHA1b140b32eeb3cb2223efc7c92346e3c4ecf65eb7e
SHA2565a35e93da45d610cebbdc4980e7a33b3d094039a49823561c8a3fb87e88f747d
SHA512b80522f835414b493c97715823902443088bd33c7e54a5fda665d73de7899df5e59c44aafdde33ffc9d71dc7c48036cee050dfdd87a24c29a9fff8ac1253acd3
-
Filesize
48KB
MD5775dac5f81248b14182c82013672c42e
SHA1cef7bba712b25da04f60f597cb614c7e4b87f24e
SHA256e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f
SHA5122d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c
-
Filesize
24KB
MD52a9b706d83be29f32a28f29be397e533
SHA131135de80dd7b7c4a27516806fbbb13d871548d9
SHA256db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236
SHA512cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64
-
Filesize
36KB
MD5bd3e2c28c647533a057b5cdf8bff2c5f
SHA1d36c80e460c5dde615ab1c268bd89309225ecb82
SHA256f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b
SHA51214aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc
-
Filesize
52KB
MD563a1e9cde10490008ba7ef47a12179d1
SHA15299af182b7cf08f95fcb3815149d7c54e73187d
SHA2569b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4
SHA512dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe
-
Filesize
36KB
MD57a016cec8851a57b2f0376ae6d1fc837
SHA1f161f9d8d7b073c1f17f55719c37124969bd7d2a
SHA25619e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b
SHA512f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456
-
Filesize
64KB
MD54d4774a30da56119888490cdf3157b09
SHA1360221725daa9b7a14460fe6939d54b2173fb8d1
SHA2560ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7
SHA512eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130
-
Filesize
62KB
MD59002a577c07ab2b99979435cd8b67acd
SHA15b3c6231c113b726ddd55fd8a8e3ae84b1526820
SHA256c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1
SHA512f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47
-
Filesize
61KB
MD5218e31b07c6e07633a84f0248730e220
SHA147ee36529b741f3d52c487e6dad151f516c2eb5a
SHA256241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec
SHA512e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0
-
Filesize
81KB
MD593030b5af327ece3ddc3518410e1af59
SHA14be27729a906169d2afcf025e10f308fce35056c
SHA256ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650
SHA512247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d
-
Filesize
200KB
MD5c30dfa5fbf9f2e6d18ceb7108923fdfc
SHA1523c4b9043cd6d722c01215f64173b9287623d76
SHA256ec383c0455491bdcab4a1e8692359543d96f82ad73602c171734ae8ce45449e8
SHA512075b726d3e37d9ba15db1aaca781502aff97b90dc6a80c4e1be20368dd1c9df13160b9d8bce09bfe467b406f7d0b698c6ace6aee5b0bf4149e4508d9ed74cab2
-
Filesize
197KB
MD5fca2f9f00de26d0b5af4881836d6337a
SHA1b11dcad7c00c2c85354b131c796ae34bbbefdb38
SHA25619e6ec40e9a239b3b208eb3f7874a76e12adbfc8b865f43452296df66a14e501
SHA5127fae923c2a9c604991b172ac91e7e9e4298c01391940f23a190eb4bd3920c97af2476f1a4730cac350ddbd8956806e98870b46137b1711b224a6174c441af738
-
Filesize
27KB
MD5aa8ef0154efa83de1c2786ab1cb76f37
SHA15e4fcdf55c34538dfdda172a985731019f74898f
SHA256db7364a16090f58ce23aeb0426b005b1d1a965307d7d4de117a553c190ba5d57
SHA51217d3c193a516bf56ee6a28ef708b01c618d5a159d7c389be6f54579638e3d9c0a9a3add7dc6e19c6f0b63b235c53bbc186d92e77c60ddc297e2df8c612332bbd
-
Filesize
15KB
MD562faa6fe395c5810fe4fceffcba62966
SHA1ed830d3d1156c3a5ea6502148f4347af0c4a8051
SHA2561db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099
SHA5124e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54
-
Filesize
90KB
MD5facce237d5cc5e89d8e92a36289f588b
SHA15b91fe97781b107df2754a5d38807a597f1d99a2
SHA256ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9
SHA512f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0
-
Filesize
168KB
MD5d2d2a9e08ad2df5d73ca0aa0797cd96a
SHA1f6050bc38d27c805daa078383506b93c5dd854c7
SHA2561246532e2e335750fcdeb3c801f98eaca1ac6579d1bdcae1c5ca89f8b24fd879
SHA512197385ac8d349674675fb411cbd246b53b0860f8cbd47b79f6f05ebefda4563e75285cac2bef45ceb12cdfcd4b4d42c47050767608f96eaebc7111dbdbead1de
-
Filesize
55KB
MD5158f96bd130a9f3a1f7e91dc611e8b7d
SHA1207264f61e8d8cd77c7dd82e7c8c38927bcdef85
SHA25689885cd48e706c533aeff66d45cfee67561db4708bef31367a546f685f30eb55
SHA5126ae9e17dddd7ae166fd195d202d73904bf6482d727f0a9d5cc01454d4a58f9da027acc9591dcfacafa039379bf151cb385ca4208ea70baf069516ff98fd31d4a
-
Filesize
139KB
MD532f2ac5f45b93b733cab1865affd588d
SHA15062e6d2a8c1e06e19c9f0b29164915286ece618
SHA25638f422c1c5751cf6796c44fec1c478a2a5379ddb6f3512004f1fcedad3b35cd5
SHA5128384c6aef7c32ac0f10aad8490d82b1553c3d194dd3f7821bbe2c75eb50a6e5ece195be6c09615f273d3d4935163c15d1c83e7bc4ef45fd1113a9f0641ae0bf1
-
Filesize
351KB
MD518a9dd94b5112ea94f3fc9fc22ff8409
SHA197a0b82343ef1599e517946a2c3c259b61e53ca7
SHA25655758341c4094ac4cbf26712f45f1ed17fc1f570197538ac2267bd896a9f854e
SHA5127bac448be18324efd337c7cffbae2c6db763d9d7450e70dd33b214981266008b7e4d0a895c7fd214d908b3eecb9a7a0ac0aba1d57c9e1fdcee3f9e72c39de3f6
-
Filesize
456KB
MD554c12705dc6a32282762bbc4252e2b9b
SHA12d1fd38b5f3db7c7f0d7baee446a00099a506d50
SHA256a5a600ca8a60a0af629047ef8b227feba5221c5697f820da69e274f40869a6cc
SHA512c4d96a8d8064ef917ddb98532360a8bf318535b310f908a384c0ca140ed058f5f3f24f34c3992da4399386f546381cbb1eef5432b3ff2b7c19e0491dec8d4aaf
-
Filesize
137KB
MD59f735917c0bba0f42b40e719047eefd5
SHA1d8c1ef036b9d841db86ffc76d9150064ee836cce
SHA2567acd536b7e7fbbf4578ce24aa39740279e7ffb7477bb77f6a2c7afbc12f16c83
SHA51265522b77519efd6d43f17848ecf65d4bfed8f07d9f4212dce7f6c905650b4107396e7067c62802c7c953b02f78e924560c8ff151e195c0cab37606be69270a3e
-
Filesize
334KB
MD54b15c6de8b0cbeb6d4d7d6e14b9ca7fa
SHA1af3b589712be828302778a6e248ebd659fcdabfe
SHA2567150db5b3af392a250b79f1078c87848a08b6c13448943d5a0478c2d37645b85
SHA5121f68f55cb4c32d0abf929b3382d9b773369f376853912829299c6386648c39807c6242eba037bb3988ebecd0e8b7197c91583243154c569bef1f70d0d958c491
-
Filesize
75KB
MD5683fc126a13b915b3ff36735ea5ca5fc
SHA1d1ccfdf78919f51b09fbde02c2cf0f332601bd74
SHA256b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929
SHA5124d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9
-
Filesize
389KB
MD51a063e60707636e76e61ad9784bb1eea
SHA1baf498bac402a29b1330fcd20cfbacbc5d245cf7
SHA256878566ee8a41806ee9b9c4cf590e1953881dde2127616a647fa31940a5096cc5
SHA51239e2bcd04f4ee4e6280b7723a628acfbceef254fbea62833a34d7f4cba566c9556bfcfe2424ada027112a8b722da8349331ca416d00d0e3d6afbec96e3d91a65
-
Filesize
131KB
MD5d8a76dfe6188e600bd7a8480dcedcbdb
SHA140080e226be118c2a0a8f9dd70879467ec09f198
SHA256a1254966826e2849b1ba2d630e93ca7b75105c8d3acd9be795d625edf835ac0a
SHA5129a01c3290be7d309e23a6048731c541cd0c602669ace34779e1e69c29da154b378edf0cacfe92354996e293bad205c1bfaf6a003840cf53216100cd39bf6dd76
-
Filesize
7KB
MD5b74686272867d5385acda2cce06fe54c
SHA14cc82ceabaf74fa031be633e7631f7082e34783e
SHA256c61a574e54afb0a60f7302fb764576adbad0bd08b916c2eab28ba2c6312140dd
SHA512202c4ccb965d2694b1cb46e5b48908a6bb34d59bdf9ea565faea2ab5a604089a741d81428ab25a98863d2e777af7983f85883df6b6eaa4cb91e6b233cb8ea354
-
Filesize
34KB
MD5a0024ee8eb91e595fadc361d22cbe8c3
SHA112bfa47c0d176b06c7c21d14ed247e530e8c0c08
SHA25629b06067d20d0f8fe19da4683557fed7c01338211106ce623bc3113b4ecddad6
SHA51260a2962472d62d0e29e8c1ef9ee8bb939a89e2073792fc6b59e0f9a572a6f2e62388fea2c3e245618925e178d708e2d1411881a50370b86801bc2abbb353bc80
-
Filesize
131KB
MD56f9180585dba733fa9a6dac458f31cf6
SHA1ba65fb48896d3334d626ca155f9591b9ee058919
SHA256566403609cb338eb377e7333e064a986671dffe07ad7280b92cdf1080d9bd810
SHA512f00e796f61684233f1f23deff57a8771f0fcf2359d882c53b0561e926d46d2168f3b366fc61a37e2cd824c2e2b64d4e919fd607475e5c248091b4a0a5bf39b4f
-
Filesize
9KB
MD537b3886a9f8810ce88cb008c723e9d2e
SHA1d66cdbfd9f2ec40114073ad8e43738103f329248
SHA256cb6894e6b6a53662c246365898fd923d232ca39d276f223b531d459814378278
SHA5121799939102785b950f73de3b93eb7aa5714fe392fda9a9cb0f4b30dc97c272287eed22d29eb8171dc20a3a509e3881d836785f28522f0dadda4de7ae860d458f
-
Filesize
8KB
MD52c23852fd426ccad47c901ae562d9d45
SHA17ce25e85339c5b2b63cda0c9ac3c523c8393fdce
SHA256f32934d2b4c96a186774a219ad1949bdd7f2a2d749a6444295ccc0dcc2535c56
SHA512f82e452b8366edaa125f59e075a284e5d21d31ff6373d25e6a188765c19db3df3bb9b46add0cda7ec1ec255c48f9407eb25324b70b3eb3b03a8e029228f788e9
-
Filesize
85KB
MD5a36d46d3dd56e688829bc1a43ea40cfa
SHA1c5662032dab7a20b19d58d0f3825ec25fc399c2b
SHA2560bb1f59626ed8e6c1168b478bb77de90c8b49dab3afbb502ab92ea195970974c
SHA5121135311f6eac6e416407d3cfe363d09a79ec88ad7aa4f32fdcd032dbd1b3caf596982ffc75be97a82adcc1854086f2b6f3cf5200cbd6c538c4f9e418cdf55a61
-
Filesize
132KB
MD5fb970f637b20bec57d197d900f987b97
SHA12ca6fdf86da0aac352e99dfea87cb1d46913d2be
SHA2560a35de01338c2dded1d6ec87669f0e6e1ccd4a15952b3231b85fa8faea3a647c
SHA512d1d941c2ce2b87205f43cde200520c9d75f06edbc1cd574c3f497fb74554f8fe8b63d68a5878360d4a0c5621d94416d03ba8ecab2db5ecd658623a62ee497c96
-
Filesize
9KB
MD510cc1aa73abcd521a9ae862cf096cb52
SHA1928bcb697888e335d04117b15c1b778b79e2562d
SHA256551a2810f335b0a7b5641a3519dc4b0e2ea87ebe54a1b5a99530e9af664d2556
SHA512cf96cd5268e1c56e7a2d6c32e6b8c1ddd56e0681a6970e03dddea9886a9e822af602e0e393cd8303498153af3e70373894d8c6fe3e3f24040cc92ff0441c357b
-
Filesize
8KB
MD57f29ccffb22bc60c212f4e20225c2f73
SHA1c61e11a4ca4bf2e74d178f478e47f8367b176383
SHA256ca8dcc49035a555995bddb906b51632c15c24fb4da212202ef8c031836003da0
SHA5129aa8416877f322448a6aa4021934393ea301eb5ff910dde5c6b92d0c07976a336911f91885fc524e77a810bc855e90442c3f0708cb49c8cde9683b02cac39f74
-
Filesize
86KB
MD5cd46f4ef804dd024fc57b55ae9869f16
SHA1c9a2bdd2dfe5e6e51c204b7722f2b6b5ebf1c6d4
SHA2568452659ca066dc46386cdde780e7e775d1413589dbd8aabd33ada354dd5cba25
SHA512eb27c656fa52fd79f7eeb5bf734425d9df416b49aa43c9c8348f9e3c8b8074e5f748fef77e25f1c0ab03165666713e85176c5d770299828ad4afcf4e31ef2f9f
-
Filesize
30KB
MD5ec4cb802f9d4fabaebb74af0e90f5d16
SHA1da0fc288046110224f263db9f8f2ebf9ee53cf9f
SHA25638ad9505f2901e75ffaab259ef86dfb3570587f63d1c99c8c1469fd42702127f
SHA512ce59dcab3e2c6d08de6e277d021eff086cd01613713c47fe500d9d0813dcb81df95ba7aaaa1269349bd973221f9e2acabbaf10df22ac694ef756893fc0d7ef79
-
Filesize
31KB
MD57caa17029f1b28bc78b6b63d98e77478
SHA14ed5510b34dc9100ec927971fd396f01046356ac
SHA2562a6b104e1a4f7d6f09843fd8138a37d8c69103727ecedfbc979324cccea072e2
SHA5125ddb372178261a059ef447dbfb9e68f257ff25f96ca31d9c59759840e43a8c4ade247c6e8bb8621a90be2f317cd82b73fbb06a2b42e31c78e46a95cd39315b4e
-
Filesize
50KB
MD55e1c42171aabc8af31f72a025c9c1d22
SHA13ce2693beafd2c3a58c05e4831f70dbc4ee6baf7
SHA256a4bdcb660ba26261417f2dd7b6f941ecc1d98d8419b7d220e9d6db564a2a4dcd
SHA512922f544c987d55cb647012b507446f574341ae582ed691c597da416528ec9e130ca1817f5dcaf6b80fe38e4293852f321eba7734b8b2bda97f42128d9556d9cb
-
Filesize
52KB
MD553cf2c5fffec1fb0a50c0cefba0c1037
SHA14fa6690b21b6b2ce058012d9a533494ece4d61d8
SHA256e3794795600a03647005f421ebc7c5a1625bde5e907b48504d05f5d875d3334f
SHA512009843a6d282adda96df96d3f35a8b4be0945d0680cf5d0cd431113d0c6bef7ae425f8b1ad7552aa623db3671e65a2c420e34d5b58688cead73c06b43803e963
-
Filesize
23KB
MD5177f9c0579d4efdc01bd9deaf88e9bb2
SHA1ab1b6523c69d98700344688a83700d8a5e9ea564
SHA256ea1a64b00a3de04b33db899b79d34ffd0c1049328f6910a58eb7c6e3f8bde243
SHA51281789a7f210f6b7837f84ac9c043e853143f9448fa443a33167fd01741e4dab64936869091750e5e5043dbc16af4e0edce8518ae5e47c09ddd0848c0a1b08116
-
Filesize
14KB
MD563492b8ea890e5c53946867923c16878
SHA10447f3d47beab807f56799f5d8a53c8c40168ba5
SHA256dc0cf462d2be33d9fcbd80098426df8ac926f5c8415519cacb94cb54b5277ca9
SHA512635f6c78dedf206c6b696390deb6682f6afdd1ff5b2cd7cee8df4e4194a79bf5c5612ab18d2123acdc2e093ae1fa9db2f8ac94689589c9c9115093911eb93b94
-
Filesize
21KB
MD510c844a7ae2695d9370619bb67e970fd
SHA1e91c9a3d8241992f00af80536c85b11a6464901f
SHA256225d170b9f0137bdb23dce772152618bff3ae63f933699c5231c17665f5faf1a
SHA512e99733245f0193df38514d56b6b27b92f3935fb9872bf7c081c1036314c565d2fbcd21d2b922972adaec6cb71661fac607ff09f8d8435e94e2f97f2b3e6aedbb
-
Filesize
14KB
MD582f7451ecf86877f9e5f37d6c6529015
SHA11dcf731f958b0fe7d60ec89b1f18f0c9be425236
SHA256fa2597d39a7dcb5d13d17ba400c3da9ea06f13405f54bb679a368dfda6e46ce3
SHA512b09c2056dd7c2758b2e0df70e82c521020bdfd01c4d0a90f58fcec2b28488c2469ff911e93156108d217494536e6a494e9db7d540781207dfa5710549cb6e5e2
-
Filesize
23KB
MD559fbac745f8cd613bd413a00c95c57d2
SHA111eb70fa65ea60cfd50dcf8061a222afb6f83e98
SHA256d18cc06e935dc71d2b35340133ed7609b108c9e02a3a1b80848763a48d15cce1
SHA5129e804437f104fbee1e33774eb481f96f914df12b9dbfadb97e1c863fe1c4bc2d4cac97decabed49a3c152fd6b8c964577841f0ed18aaef43a72124de1121d329
-
Filesize
14KB
MD53cea27474779b3f2e76b191a3d81d07b
SHA1804b757a0f0efa862328e901c30edebdda493cfa
SHA256d34e799cf81874826b1f3000dd3584f6fba5a8c4aa96a7fd83ad18e708d07045
SHA5121fa3e9861bb3ecb1bbf4826e532a60246860b6fa6383d426357a09824565935f5494aa3f7b7cdc5968bf65a19a679e2d59ad5200a9d6811672cf79ff9de0e070
-
Filesize
22KB
MD56bb2524b8aea918c2f07639825788d21
SHA1042911ade724b6b0ba62e4726eb490bce4babb7e
SHA2567866d4d1c406ea1e80d0129225a11753ab30e2e9bfd11b073b840dc56cfcfc14
SHA5129895876be52bf45f38044d192cc0e0fae1023ef0d9cbad63c0eeb085d48f41720d4a4e96fbb4f03eb9f1c2a5e9116a5981c8eb592c6889e6cd5946b188a488c5
-
Filesize
15KB
MD53dffe3a71f1e98ffd5ee5de23922d57f
SHA1dd650c972e0f8c8ae4dc61911d10a5191e436de6
SHA25640e9acbfbf613035c665fcfc7623e469d1af8023e50d6ada3b837186536c9e2b
SHA512bb53fb57b9adbae9fca5abff7bef4020f52b5c23443c70e5d41554cbd6ad3eb791bf02cc46f24b8501a28b049785d24f62e378b902c7e89302796fc1f78f0151
-
Filesize
21KB
MD5ff1ca0842bb6f889f57dc9854f435bfc
SHA1dbe78a01e7f3262742c570a7a757c39b68421a08
SHA256055b3f5697e6b4d9bdf8d3761c8261799fe9b1293acfdb7d18c61eb8b1f7cd2a
SHA512bfbff03ad6cfe8a8414831a5d3f389e9956e5680a10b6eee1813d0970163f4eb0fc2eac3c1c20503ad28c942334344052b90de85c1e742ee9677e3de01aee5a6
-
Filesize
20KB
MD55e2292fe3085b7a4ada3065de7f5809b
SHA19086154b762a75879445819e86c112fa1f3a5a9c
SHA25671ae2865828ce7ac9b315105a99093042a31523c03cc1d1e824d5e58e462f19e
SHA5124c962144e05c8795bcebd614e0329bd905eaa252e3af68ad7938f5f4fe55028371080127e4bef4fee609744fc5bbffd2755b805b9376bf7ec095fe078f926d70
-
Filesize
20KB
MD54113d34fe732f5e29a71869879027443
SHA14373b06c27c333334211620cf37727772446dab4
SHA256f2ce9f30fa57b04e87299922a7d09e51fd196586c8a2df91789bf1b773a4c9c3
SHA512329948f1a6f0fa4d2996ad052ca0db6bd051cc3546e417a09df29fde1384b4a1e0760657849e1ee4fe887c12f45ccefa217c8391d9b75f3a0d7809fcb4dc63fb
-
Filesize
17KB
MD5831930fd1dd0382b608faed657c4e8bc
SHA19209b748f0a841973306fbcd2b190285c433e2c0
SHA2568154ad45a5bd94d3b6615117dc8bd42c483c845bb29e3a05ae27fe99481dccc7
SHA51223acffa8771053c97f4227155837028808d5bd3bacfc57c7e0906a48463dffa4d60dd1f920ea0b3955e97a33ee21b5c30a65303863e53ebe94c23168450432a2
-
Filesize
132KB
MD53cc2f52ecb86405f5b243dd0069b0d73
SHA121cf6959bb6e7c2ea1fe7b03db6307433b2e46f2
SHA25695a96a1433903f4d7cb24474fdca566b26d5f5964192955352f489c527d6336f
SHA512f1c725189b5a14cf043383ee096941a6b39ba42e1ac981bc60fd5cb911df447698718bd4eb776ee81b4d6f7969acecaf4377ba552f205aa383988f8e8f0ded58
-
Filesize
11KB
MD52cc314aa03697d8433c7e11201a157a4
SHA1c3bbbf9d308a27d66fa4214df7051919ec56e518
SHA256fc4ff8d1df0e6de03669bb009d740e436f004dc5e19468bb76bf9e9861ae3f41
SHA5122e10a3fd51ef060e8eb8ea17cee06de2fddc2a57cf69eec1c023057563f6b99bf772734c8b7ebd30b746e7926df329398f1d9003a8081f3c9bff5f0bdf1b3571
-
Filesize
9KB
MD58a1068714e26fe78ea4e81ce1b98ac8f
SHA199c5b7c9907abb18d5977b169a65464254482c0d
SHA256a1162ed0ba25cfd817aafe4219c2005c4fc875cb402d3432a8796554e3a9fea9
SHA512d0087e38d04cc26f41f2fd9551677a0c107498772beaf64288e3dd70c1c4c7547fd07f27e951c53e446429f6505479f747776fe2026d8915d64c408766a0ab8e
-
Filesize
102KB
MD5e104a781efcd5eaa6e16b93db3586502
SHA184b5177be53c02830a09b90cfe88355dc99ee433
SHA256b202cc9047b3e8df166d08c4dbc9b3b191e6785cb8b6439c83b9b2bac03c5616
SHA512036e12edcd59b7a9654d8581f4589c4c5d4987760aaeba990b87960ad38de2140698ca342e57dcf7a24c8a74f0c6d541e07bda5ef8fb808e5d2807175e80c410
-
Filesize
99KB
MD5956d826f03d88c0b5482002bb7a83412
SHA1560658185c225d1bd274b6a18372fd7de5f336af
SHA256f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d
SHA5126503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647
-
Filesize
1.8MB
MD54e35a902ca8ed1c3d4551b1a470c4655
SHA1ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c
SHA25677222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9
SHA512c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30
-
Filesize
684KB
MD550f289df0c19484e970849aac4e6f977
SHA13dc77c8830836ab844975eb002149b66da2e10be
SHA256b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
SHA512877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
-
Filesize
816B
MD505ea4d7d3fcfc5ed4b76b0c3e1c7cda0
SHA1bb2dafd5cf78979a83e31cfe85055104dff5e01a
SHA2562a2c3bfac69ed00267b3bf1f78752b0207a11fb721634ef209b387dc01495cbc
SHA512a5c159ff09f5f2f426eff2981802ad860c918cae21630f9b946391e5baf9e8ec8c806e5dca85f41ebf7d8a36cb405803903f8222f88893d5f2556dfaf37f72c5
-
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\UserDeploymentConfiguration.xml
Filesize875B
MD5cbff31f1b23fd2207926d06c6503824a
SHA175da5ec034c58be3897483bde1bce72424c16977
SHA256e989f8f45f72b9160c0bbbfd856d32ae8b83ec4fb9ef41d2748545ebca73d14e
SHA51247a7658594c1683e5f905b92998a3684c2324646c7b77600c248a8a3ff18e3338969a8f4506944aae71fd433f6e44b5a8b37b2edfdbff363dc07c0d33a247a46
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
Filesize193B
MD505a8bfa71a5f65da68bc09688a9b30c7
SHA11620484f5210e0e719d0363d1672501404d57bbe
SHA256ee55ddf4cda30cd0f0fdb4fc2d0bf9ecca5dae113d1eddd9b935de8cc7ff432f
SHA512adf9dcc60912800a0a6d5884cdcdabd82e7fda43ceb49258264cf5d02fe402d36720319fe5b386f5719eb5ba7305fdb8568d126d0264402d84fffae247a49a04
-
Filesize
178B
MD550beea27f647cad446fc06d97bc754fd
SHA194e9317d53264459f822f328f1d883df392a09d8
SHA256dd8ce7e8437f0775742f24d51ea016fb440e585f4cc968a616282ea88b67a0e2
SHA5126c2c279f0c7c90dbe2ca221f4126e806e44a6de4565bb83e675d69e34fbbde0e9edaf94861f0a9af00001a2a78c2673e7cd3d6339ff2535528030b3813981d62
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
Filesize102B
MD57d1d7e1db5d8d862de24415d9ec9aca4
SHA1f4cdc5511c299005e775dc602e611b9c67a97c78
SHA256ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda
SHA5121688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477
-
Filesize
127KB
MD5a1f261b05208c96e78a35f5aa3dd4d86
SHA1abeb570e706bf950dfaabdb28310175c0f30dcf4
SHA256ef8357be4f9a0da42b0d69939d77a30aa3e98ed8bf1b745903dbaa67b41e1bbf
SHA512255bf767bbd61b0bf9c657a5bd49f0307e7b9b6f620086565b7374080164e40e2876809ccaeeb0328caaa85614ae59dd1e71192e0eb20f8bca37cc24c2d80158
-
Filesize
2KB
MD502f40298aa9c88eb5435b7c9f0182a18
SHA1daec2b2737e8e450b494f13601c560ff25c8696b
SHA2562a782f4ba2d406beb3b325ea698d22da24197bb16be88cca765a7c4003500097
SHA512db689b317a40aa50a4bd910d474a5bf76fa21e5e693fd1db4a8f62fba5fe32fbc290bfb5e4362e867803fcd814f6c9870c2e28d94bf7c4ac78241cce498f2030
-
Filesize
8KB
MD52d02217591cb710706e492dfbc423293
SHA1802f7268bea0a373b1bff8eba9c018feac3a36a0
SHA256bfcfd52f06c4f8e01955c9d3ce21f311cdca915071046009816bcde8429dd13e
SHA512a46b86fd3257d0b0374c60db10a8466fcb5e425eba85e15c987b5a788961f9ed8d08f2365a667f5332afe3f79dba3f6b85dabbdd507b7bd9cc1b15bd6e82a166
-
Filesize
152B
MD521986fa2280bae3957498a58adf62fc2
SHA1d01ad69975b7dc46eba6806783450f987fa2b48d
SHA256c91d76b0f27ccea28c4f5f872dee6a98f2d37424ef0b5f188af8c6757090cbb5
SHA512ae9ba1abe7def7f6924d486a58427f04a02af7dd82aa3a36c1ed527a23ec7897f00b0e30f22529e9599ae2db88e8abc7ba8013b426885aa3c961ee74678455f1
-
Filesize
152B
MD50fcda4fac8ec713700f95299a89bc126
SHA1576a818957f882dc0b892a29da15c4bb71b93455
SHA256f7a257742d3a6e6edd16ac8c4c4696d4bdf653041868329461444a0973e71430
SHA512ab350ca508c412ff860f82d25ac7492afb3baf4a2827249ebc7ec9632ee444f8f0716389f0623afc0756f395cf00d7a90a0f89b360acdf72b1befe34eecb5986
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\setup\Uninstall-PerMachine-2024-4-20.2230.4068.1.odl
Filesize256B
MD5a086e8a6483735c343548121c7a9443a
SHA1adf2789280871cd7531f427d25e5ec2d63ff91b7
SHA256b45b7bd9600fbaf04742d9e3d81750d8521f70286554f312c92b108580ae8be4
SHA5128a438f3dc38bfb787556e9d6d2f18d9f94a3ff48a711561c3cc3d74d80252dfa6001a11d41639bf59058a4acc9e049626b066c865596d04d59f73d8faeb83337
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\activity-stream.discovery_stream.json.tmp
Filesize23KB
MD5cff66900c61eabdd21b1dcafdbc14b8d
SHA1ac0664209e9eaf8a979599754654b65aee57ac99
SHA256a3404ed35a11d6764f8b7243d06c3679388220fcc69c43d199910e9c8cc6739a
SHA51255f7ceb92b78e7d2f96cb55db9f7e469c9f0b068dea415c6d71a8855c66c4c01772562b70f33841633effa80342eee0bf0d9106bb880c810c47bbea9f323ffe6
-
Filesize
10KB
MD5ebae39bcb29e076873b55159bc23f95d
SHA14b7404f49930d1d3634d1a3aeac74c54cab35e7b
SHA2562297ffc47ed8f462925c408297d97b1c9acd813b6302c224198898e018a1e9d1
SHA51287212931166ac88a9c0c55c0a4fce40496fab1ab659a46209df597541cd41709ab1cde17c8c5db3637fcb38246eaa143b84ec9db34e70310efe9fcafa36dd458
-
Filesize
11KB
MD53167a308f793c105f37f63991783f2e9
SHA1ea1a3f63fb2daa95eb1df445cf79d35c4ba31fa7
SHA256c7cdb5c690a7c8b7ded0a0a4c8b480aa1907913c30b7ec7ffd5d32959353ff9c
SHA5121f49a69bdb209be0635c1e7fd5957158300da096f8f2791ec59740ab0eed776f81ec7439a800e6fb0a52f90564e5c44bbe5ac5924bd2adc648c444060bffe1b6
-
Filesize
19KB
MD511d4f16c5c22faedf571d37493045783
SHA1d28209d80ed8f31f9ce4627e2e2b7e34a4f9d643
SHA256f19b957d8aee0c3672bd4ee5f72bf68ac289a4537e79e3a3141e696f14d268d5
SHA512e0164f2c4688f2db78b27d4201777836e36d0ce0c1226689781373f0c8fb2a9ab6cdce41dfff22768df13db1a6991c70e6327d040ee12eae71b23b12226c187f
-
Filesize
63KB
MD5780cd24f8daadcb46745bbb6bddddd8d
SHA1459949fdd21b3f5d02ed768caeb6af3be206e595
SHA256eeb02391bb8a5f0050daa2778272961ecf6ee8b89e234499efba5f8496940f7c
SHA512449f06795e69764d32742b46d6161964383dedfdec843aead581c1a67998788ff9224aa3300e22de8bede6a5fb76b889b83beecf7d5c7c8d66c2bc4659b1945e
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\cache2\entries\2AC78448C65FB1371AF3C5594A3F20C6CAB997BB
Filesize207KB
MD53cfea51ab7ec967c2879c28c22961979
SHA192e6bd7f719051ffae58e0e05411451fff563d50
SHA256f4c1a83ffe42fcdfde194fb56ef1fdc990d09ccc8caba706cc44b34e8adecc32
SHA512872fa7f79bb7702f1346edaa1bdb8d8efb2d27885b834e5a8667e102f7eb762f63f02b4284c79021faa1520d806d0a18df90e1bf68541cedf61cfce76af888f0
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\cache2\entries\A4CE164F50B862A9A4129172EAE07F4D83D47575
Filesize43KB
MD5ce01be2c533e4acd7348f2faf361072d
SHA1f8856e7f36e3eeaf66473068fb9a17c27e9e38f3
SHA256720b7ac11d5cf46010119e669357ab427109df99be5ed3a09addd28d455387fd
SHA512f64d1beeedf25a1c930dbff3329f29e67632c21e8479c209d74158d04361aa60c1ca73a817163d602fded81a081cd6c151cc3b5630e29c79a14a4b663b5767ba
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hzxwviuu.default-release\activity-stream.discovery_stream.json.tmp
Filesize21KB
MD5457499b0a08c8ff725e6e8e1493a7b2f
SHA12b5a2ddc3a60aa997d672aadaf73bf965a27f461
SHA256e568492b3aec90b217ecd6e3e293feba03e93ace899273085d8a32ed68aa551e
SHA51280bc2e8421ba73f1289f5d3b6391dcff1b76d4b3973895a99498ff3d5b49bb501481453826442f2411f0e5141ea3110844f9dde912c1e3d1ea4cb2bc0a4fd007
-
Filesize
33KB
MD53a49098deb7db0c854a883aacb80eb42
SHA1db7b4922999471f1f4ce2db01144bf54b8419fb5
SHA2562a9df33a072ffaba27cd22e221bbd6734a1df3d2e8b7f9af069ab68187a41a36
SHA5126b4cb6fd51acd817a1c4e90419286f615a579b7c04678dac0299aaf883aeb6279662289c56be00b262864c2db88470b2c43fae887383aba77c3c825aae86ffb6
-
Filesize
24KB
MD5b6963089f9927825a9e1277f18294757
SHA10630e1057803282710466f3ed8f2f2e23b829f2b
SHA256719121cd0962917a76c7972c08c4ca449fe376da47d09bb0c3d7563268b7b191
SHA512f0000a4bf633a7061babe1531730bb61bd2ec13dafbd7c8d0234779571b6915fc58c192c22e2b43119e9df2a887e383555fa6f2807aa62a1fd9f07a8067db952
-
Filesize
22KB
MD55a0746bcbed811b29d7ee58b9b4d9de0
SHA1e92f5944f6c30602d20476c851e0587be2a28ff7
SHA2568d99369ee192a3e593ffb023aa53fd7319775f5d251f0b01758fcba238eb1303
SHA5120edb8b35a1367376180fb0b0c299f950835954b9f7d5fc61559c6dc88cb4f38bb4e299f600bd34ec1d6ec0d204c1357e516b6990b079b45ceead6fe61b58131f
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hzxwviuu.default-release\cache2\entries\C72D4296C2EBC6FD41A9F780CD0C8F30F0FF937C
Filesize13KB
MD50641836463e96ab8b0fd4c161ebec95f
SHA184a13d6bb12a6683b8ca7f8a0162ffa0d12d360b
SHA256c7da54f73afa6efc3bb6b8912e2e966fa89d63cc9aaffad2cd353f40698e4ef2
SHA512c575887f505099f9c11e31998268d1d642a3997bfc3a58e8b37ed8565d7fea0666238ae659c49480e9c6a3b768aec61d4c2e1fcd58d320800d8b87ea981c42a9
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hzxwviuu.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
Filesize7KB
MD5c460716b62456449360b23cf5663f275
SHA106573a83d88286153066bae7062cc9300e567d92
SHA2560ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0
SHA512476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30
-
Filesize
14KB
MD5ad782ffac62e14e2269bf1379bccbaae
SHA19539773b550e902a35764574a2be2d05bc0d8afc
SHA2561c8a77db924ebeb952052334dc95add388700c02b073b07973cd8fe0a0a360b8
SHA512a1e9d6316ffc55f4751090961733e98c93b2a391666ff50b50e9dea39783746e501d14127e7ee9343926976d7e3cd224f13736530354d8466ea995dab35c8dc2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD50e828d38579233228b33bbfde97bb4a4
SHA1f0ff7daa20af9ec4900cd79d71e1326aa1e2ff5c
SHA25623bceb38942a7a27a4cf0ef483f47efbfb019ca7d3f08dc070746651408aa672
SHA512632864c94ad97291685b60c28c37e1392ae329529eb93095c6bd79a7851eb8b44675119a1b3606fd1644bb785b3707fb398ea8c3e443cb389a89121a0996a9e6
-
Filesize
22KB
MD5b361682fa5e6a1906e754cfa08aa8d90
SHA1c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA256b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
SHA5122778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
-
Filesize
7KB
MD520850d4d5416fbfd6a02e8a120f360fc
SHA1ac34f3a34aaa4a21efd6a32bc93102639170e219
SHA256860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61
SHA512c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276
-
Filesize
26KB
MD54f25d99bf1375fe5e61b037b2616695d
SHA1958fad0e54df0736ddab28ff6cb93e6ed580c862
SHA256803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647
SHA51296a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130
-
Filesize
12KB
MD52029c44871670eec937d1a8c1e9faa21
SHA1e8d53b9e8bc475cc274d80d3836b526d8dd2747a
SHA256a4ae6d33f940a80e8fe34537c5cc1f8b8679c979607969320cfb750c15809ac2
SHA5126f151c9818ac2f3aef6d4cabd8122c7e22ccf0b84fa5d4bcc951f8c3d00e8c270127eac1e9d93c5f4594ac90de8aff87dc6e96562f532a3d19c0da63a28654b7
-
Filesize
23.2MB
MD59e936c2078b286132cd6b9c8602fd17a
SHA1f638b8a7448daa6da754c9bb2fbf2cf4ee1b007e
SHA256fa994badb1e90b2629e0d955572ca57efe97169d20d6b4957e2f830e3680da9e
SHA5126973f1eef2a2baccf2b0bccf5047f6db434698cd483c0b0dfbfcc2230c45bc1ce4a23e67b5ab7ec8767d4cc8d75dcc76eeb347038eabdf5ec99bc12e3a3bb946
-
Filesize
2KB
MD5fbfcbc4dacc566a3c426f43ce10907b6
SHA163c45f9a771161740e100faf710f30eed017d723
SHA25670400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
SHA512063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
-
Filesize
5KB
MD50056f10a42638ea8b4befc614741ddd6
SHA161d488cfbea063e028a947cb1610ee372d873c9f
SHA2566b1ba0dea830e556a58c883290faa5d49c064e546cbfcd0451596a10cc693f87
SHA5125764ec92f65acc4ebe4de1e2b58b8817e81e0a6bc2f6e451317347e28d66e1e6a3773d7f18be067bbb2cb52ef1fa267754ad2bf2529286cf53730a03409d398e
-
Filesize
126KB
MD5d7bf29763354eda154aad637017b5483
SHA1dfa7d296bfeecde738ef4708aaabfebec6bc1e48
SHA2567f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93
SHA5121c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
117KB
MD5a52e5220efb60813b31a82d101a97dcb
SHA156e16e4df0944cb07e73a01301886644f062d79b
SHA256e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
SHA512d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
Filesize2KB
MD544aba3489c46738a264739bc2cf72057
SHA1b599f939a3e889e4350e4ef27d393c63667c3ad6
SHA256d12160a348c035ff3ab016257376031d4488e8e649d2c7c693f9dc44a3d1c86f
SHA512681f60b57fed3e14c77b35d13922e2b15d6f387357e2957519448d1381b9c9c8db7c83d7bc0c3297112160e2321d89adadcfc12f0bb736c0bad09a84761c5987
-
Filesize
141KB
MD59cd9fad01682c61a410ca95d9479c07a
SHA18ce7913d3244cd39854a08fec5838142ce31245d
SHA2567e264c24203458c6fe03e84a131dd148837c942ae3d0010510f531142f3fa8a6
SHA51239930a6e5ee8a8241824c26c416d9696679e2f73d7b8d0ba223de0f46f84a8c8ab6835bc78489d41f11afdf087861d3a2c8ef3e96ad27f2dd9d2072c59d55c57
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\40371339ad31a7e6.customDestinations-ms
Filesize5KB
MD596d62029452d89ba7c7c941cd13ff82b
SHA1c54d6d17bd062d2f66953c4718d47edbcd5f34dd
SHA2563bc0744c152e079aeb46d836e62ba14978d31b902b575595e7c873b92e1a5150
SHA512532473ca68ebfb978e7915ddfca9257a1b8d38e0fd3ac20e755f9d621c5a10d236ee7c72715dae0a260fc2f1b330e938b0bfc6888bf6ef1e7fc5a21dd1167a5e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize5KB
MD515fd7b8279892773d567012245ec0509
SHA10a262b67043ec43d91838b5b3b488c805da56c79
SHA256d4ebdd63cd988720e1daa9fd2aaca95b7cec1f65a17a41ea6de2bc8d968ad49e
SHA512fb01e7cb03a874e2861bf4774f920e82d97f67f974c3f187725cadf2a010eaa9251f8a1aae5b24e28b6a0b39a95ea0be27b797c2b0257185cdbf481dde009d54
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize5KB
MD57fd08c3222ec3007254b6a03852fc257
SHA19dacabc59fe3d7645e5be2e08b71b2bcf7253ef8
SHA25604eb48314c3e38e93085832da9d27396b90529d0fa31d752fbc94fb9f81b4e63
SHA512e89deede761b883c3500df99028b493a618c87b9cbf5bf7390f7b2e0c46cc1c52eea9e7823f33cf013ae9b85860bb3aeb3e8f034de534a1d3aa333aa1c5730d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize12B
MD5e4a1661c2c886ebb688dec494532431c
SHA1a2ae2a7db83b33dc95396607258f553114c9183c
SHA256b76875c50ef704dbbf7f02c982445971d1bbd61aebe2e4b28ddc58a1d66317d5
SHA512efdcb76fb40482bc94e37eae3701e844bf22c7d74d53aef93ac7b6ae1c1094ba2f853875d2c66a49a7075ea8c69f5a348b786d6ee0fa711669279d04adaac22c
-
Filesize
876B
MD55fa71d95545132e20c5be6e406bc71ce
SHA1bda665f806947ea5478d4037c7b72fdc622be716
SHA25674aea7e67f16b75a49aaeb3fead4feb77fdf82c0a41cd46db3500bbc2fad8f89
SHA512fde332168647e4cede83b939bb1f789dd185ee234ad3018b0c60434e86b71cdcf2148606aa8ce38b90352fa0de267229f13144fb04c2ea661d90824ec5c0a7ae
-
Filesize
7KB
MD5870d9baff334baa85d28f99212c6cccc
SHA1295add386609c9ce102105bd057b4c18d3000b8b
SHA2560609b16151ff224070c572f9f1ad19c6bd906928a29f1f2f284079cec17d782e
SHA5122a45b19365754cef1c1b8623131610c6020f984f730f8d233f15d539bb602169d3ca10f561b0e637c75b1794ff88b674075e273bedcf269992066171f63b8cf6
-
Filesize
7KB
MD5aafd059d8a5936ed5453ce88f67a76ca
SHA13a976639db23d1f6e48d10e2bbb5cfc9e78169ee
SHA256181a78eec2bb83d61cd62239730cf02bab4d6d04555a323febb657f7bddd0e21
SHA5127fc7a4b8c6fa7f2e49c24e25d6bf33da3a22a0fda73953f9f1b1506b64990530ab4862504e80f1946c3c1ff9ab5ba92214f8b912f0a86c312f3389e3a24a264a
-
Filesize
6KB
MD5cdcedf49d4f5e13d1adb4861c1d7777d
SHA1e57b0e31d90797d6bd1ef9307423b4e9a505e3fa
SHA25642145d0797049673b1016b5900d6c31dc77f86e66f8ad80a17f8b4e0c0e2157d
SHA5121f397ca6a782c9adb9a5053f06fcd7d1cff895fdee567457061f8e164bbe11edbb55ec6a637eed7aac58c8b922a7e78e5b2f297bf19218f5cb7b3099ed8f1292
-
Filesize
6KB
MD51d040c8cc37e847e4dda8a324777bfdb
SHA1b620edab48e7e2e17ff2d854edfcd94ca601a513
SHA256c20d4ebdbd6f75006cfdd96ed0313cce74ea20b32b6cb18b1ae25f8a6f9b3291
SHA5126131982ff62f6b9a3332f91e6e8f0d7a16d4b36d4e9f37052c5c62a17bb4568e1681761d41e4b1bdff2257b5aa3efed410155d98ab228dfafa2bd157bebbe0bf
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\serviceworker-1.txt
Filesize164B
MD5cc78b395b99fc1f55ed7753fc7bff7c7
SHA16d0e1b7781733aece35dec71e9076a7ada39bab7
SHA256e7b106742649399ef83fb4c1af31af728c13a2caedeacc27caae364c41efa3dd
SHA512389a4ffafd8dd847f5d2a47c578605c78f3ca0048a47a56e94847ff8d7a9181bd4e1b462b95c49d6e9f334610346ef6a87a52af8d8a871e05b83049a231a5f81
-
Filesize
149B
MD550fea88fb688b1b899f856267db1eccc
SHA1c3f60a70370913c5df2b11f431bc0db769fda9ec
SHA25694ac1bb4f49f96b2e30c832fcb3aea27cf42390d33233c459b1cb8e31a751d61
SHA512196bf4b35c5408623bd1bd6d1270baf590251b0b11ed95a2e47121fb5d43df0faca9bb1f1b1c7fa0d3d518bf5ff26e42b2f1a7b192bc4f86806436cd772fbe66
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD5bf42ebf7ca70228c369b721e778c11ba
SHA13af25a6557050fbe8f683b63273c3d9e9766ce47
SHA25616cf5ae2ad11b3e7c30b9d2713da8f5c4fb1959f95b8b9387a483d2839f56328
SHA512517181c8dc03d964f1cee61534a4c9cdf10511f49395096d378b508743c6ed67bedb165bc811e2b8678754d1cc7f272ba979adec78345f4df0edecb85144218c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD59d6e1f24562f835482fb0a91a43ae436
SHA19c1996e6fd0314bdff04c6805eddafce7bd96137
SHA2564e84553223a41a4ff60bcb51ac27467baf435fed2f297cbd2ae62cfe46cc7873
SHA512b2e500c40531171e97870cadb50c7370e70a30b7eb6ebf6401288bd68f424f7761d0d9ba56f81cac66c11b92bea986449e5c81852b27a67bbd0fb543e78e215e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD5eeab4434742631ddf0861dac2c381e76
SHA151984fd14edc332a4a44311f484b7291180ef6ff
SHA2560a87c7eadd7381aaa230a1d3052985898a3c71b49ca12914bfcc813088090f5d
SHA512bbca0ee5bb0ed69da73c82258bc67d0e89f891723356b524f871a61c0a2c98e5553a8bf28206b2d2a6e2a2fc4c3c8de5ef7e2fb1e76997c934a9160a0881685f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD551f5a430568a57ca9ab1962812d584c6
SHA1972a73fc68ac3d083b61eb6b8a5c1bf510b3bc61
SHA256a8a79f2355f704a74b44bc9039437b1564165fda8bf8e7dd996ddacb04e137c8
SHA512b94be1ea0790fbacd774769103ad26330a5f3b0301fa84a9dc88b3e7e228d8572ccd219f6fa0ade26f62368f95f68d28fbb08b5673a00e942bf51cf61d936f47
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize20KB
MD59c44a51a1dc4d6dd11abcf170ac125d6
SHA1a638d491266ddb7d2ef64fd8189ec4585c037631
SHA25650f70996cda18486fa6660a42b5dd03a8ed474e6939293d8456ab1d6c594c00f
SHA5125d18606f4d660f1393eece9a097691b6a1e8d83c030f697a21a199bf01d1d297382e8f73babb780ea9962c3ad08c4a21d5cce0a1b8774e643228e8cd97491818
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize10KB
MD57cc21f9672beb99f8a3818a9b3c60371
SHA1bed7ebe202d91efa5402a1698abfbb3b145c1f0f
SHA256cf3814f451b2c98d6e747593c8efacd2e767cb1a53aea59552b2a6b0065f5b4f
SHA51217aa31b227ea0c8c3b325304b8cd353300d28c60c44b736a1705615d4ad7ed7641ff78b6e0abcf6b461b4151500de4e98b9d647b69791afcdf0f4237dd175ed7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize23KB
MD50cf6dd75401165e377717d23f056bc70
SHA1d6900a2bf28603f52c657ddd29b76c70dbc6a06e
SHA256800f96105d49710a4cfd55de6bc2a27737b1b57dcbf2ba011dbd67018d047b42
SHA512b78674b3fa55ef11fdc3efb40f7d76e18a5bdba2c327b0c953a6fc51a46f376da14145c2ecb904a40bb968ed358f01f9aab859cae6931ae28989de53937ae9dc
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize21KB
MD529529a4cf85d4556aea8f4277ffd5727
SHA1176ab2b835881e9b1d0f9e31858d799a849dc1bf
SHA256c1b6f4102822313a870c270db98568e85e5276653a10a4ee218814fc2fc703e5
SHA512f59b9bf479020073eb668faab728decb97f881c3352926ef1d198678848c239512d60154abe5d7877b16b67837e3e4b4a46d0636bbe147b1a043d16dce05cc16
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize28KB
MD59a8c9bbfbf3e604ca6fc1e34db159be4
SHA157a3596ecbe5162742362a7b3ab195504f22dd05
SHA2565d6dd0a09099916c9a3051f42f0e7ed8e288db66d70427d23ac51a0dfc1958fd
SHA5124919ee87de8bd04a6f74bd7e9455bfd576431396b6d07150b906ccca0e388515a259309fb17bd60ced9528568e3f13f7d7fcfc7c9d19c0e861e5bdbe4b695749
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore-backups\recovery.jsonlz4
Filesize30KB
MD5605e4f50d55642de5010b5fedeaad57a
SHA1e12e1cdd7bc82e236bd583e52c3d11c294300e88
SHA256f272d07fb2637d9d1fa078b67d63f862defe9ea7f7ee4f644d8e74476640ae29
SHA512c7f5edb6d627ffd4cf483d0ecf764f0644852950d85d86f9bebf6e37cbe6fe2fd11e4e81365cd7215f8aae0e0ef6726d426bbece8d7ca93190e800738469da73
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\sessionstore.jsonlz4
Filesize28KB
MD5ffb8af806a18171be7180a71ec2ccff2
SHA1cce7a88c666186a2e3d59d42619f2ef33df5550e
SHA256173265c4d04f320f5c53ba350e587553b455c32c6b2ee8770d0ad21fbc9620e2
SHA51293792a795908a127924df64aa93108dd4b63d7685a1cd8b10af45053304f25c54f4380798ef42cb6bfe0c0f3637f72dc174e27c7b63e80ccf0fcfe6248bcd8d8
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\cache\morgue\168\{168fb0e2-c680-429b-a28b-53a456ad24a8}.final
Filesize41KB
MD5e792ad3d01ffc2a8d7b80c481da5d241
SHA142329c8d70bd3f6adbfec616895e8b6087341c85
SHA2568f5fa21ea8b0af3c3cbe010350273bca38e79f7137c328c2c6be499076261c98
SHA512bf2f7fbb514deeb49bd2b87a2072da793dfedb12b48514331af102ebfda12cf62eb3479895f9bea0dcd0b364a01003455cd65e253b6b0073d0f49aa02e291214
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\cache\morgue\169\{9134e620-ba54-42b3-b2f8-efeb49ad33a9}.final
Filesize57KB
MD58592270c268394a381be09cc7c39eb0d
SHA1a0646ef526f6ff743fe84e8d37a6b53bbe463931
SHA256f9811e29f6171a2d19e656a551c7afb30ecc518be30b3b9d5d4b449f63225aa3
SHA51295c06db2d079467744140f9ea661ba46acd8d335966fcc25d18a0351dc79b917a24dbc8570dc0f90258c098795f7cb6ca1c91a2bcd1661d517d5c04e13bc9f1f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\cache\morgue\181\{5ae3c7ce-c28e-4631-a1a9-020ec8edb8b5}.final
Filesize13KB
MD53c01a2a6c29d189426729620a7af042a
SHA11c0beb9ffb76142931b31806ad08713d4661e7e4
SHA256e6d1ce16f366e79f06a692b5fb80b5fccfab5c52689cb9fe8f3992c3ab9b4d70
SHA5123908436f677e0c2b1ea5400374a9074564fc937a6ff3c7939cd0d3b280fce70415545095f322f95fd577365c8b313b168a988505bd736633d14ff54e490d8029
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\cache\morgue\182\{185e075a-d084-4d6b-816a-c31e275db9b6}.final
Filesize4KB
MD5f0a95ab4a274d38e3d83f4ff2787e9ac
SHA1c3d7d29dbb579eff34cb085facbc61a40f998379
SHA256a90a145ff5374a71a6355b107fd818b24d428b8c6c148baa2ac0344f4bc9e9fd
SHA51293c06efc630923597b37c7a73ef99240a81240a644bcfe0c96ead016e098eea8040db03cda18bd7ead47e1c4631da66901a5e631b4318d2cb72246dfb1bcaa3d
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\cache\morgue\204\{088bc1b4-1615-47a0-b771-da3c0535f3cc}.final
Filesize87KB
MD59ce438c0b605937c24badb7fa10dec7c
SHA136d7fdc4b8f021bf75e5289bf5ae682986f6daf2
SHA2565d8ca2c46f7ba50b813c2b18f7dc1f80129933894b78c0a819ac6a2722a63583
SHA51210f029417ecb7fb5857812a50d4b3ede44aff361107420d528427f16e60becea12ded493777ac2983b382eeb88154d33514da2ad8c1cd8ffd36aa4da268dad10
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\cache\morgue\255\{7d8c8d99-6d6a-4a47-a248-b996a38d32ff}.final
Filesize2KB
MD5ee4fa843a3fa412cb49dd561004b7595
SHA11ff3a99b520d481a3f1e3bba36b01d8c9852bd5a
SHA256e047d455c5ff24d77910554311aa77c998dade63d05e702886afd73037a203de
SHA512f3061a505aed74a2f151fc4aa8b5ad161a7b140686ba29e26c7a1d2a2abda90caeaec281d7929ed20a4b5156bb60c12cc7dbb86617c8e2831c9eaabd40d47461
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\cache\morgue\72\{6891db2c-b286-4147-a886-cad38bc24048}.final
Filesize62KB
MD5f6863661dfb7ec92bbb1a5b316ce9120
SHA117fc0760ed2a606c815723725b4f92784209a9b5
SHA2561fb1a66d961468bcab98341754e36e4bdf4b06f722226f1492cdfe449478b188
SHA5129bfbe88010def9ee57120ee82f86b722042c9d241a0d0414de5e3dc304142de3a77d754f7400b0aae9068e9d5f594deacc4693caf9f85c0fde791a13dc57a1c2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\idb\3211250388sbwdpsunsohintoatciif.sqlite-wal
Filesize40KB
MD5916d6f27995afae416679fee5514e94a
SHA1220889e846aed59c0b3303602f7e9ecbf3a447ab
SHA2560bd6518057d693d0f6a83e002958a440ce6fc0d8dae0d8e0c3a6915cba7e3c54
SHA51274e7ef12348e02c0cd6a7c58a4a2ba7caa70fe24b5f4a545e896d26a10723877275800347d1b4e1e9a5b50bc48928716f612dd2d47bc87438bc5fe078236ba0c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dsfbkuj2.default-release\storage\default\https+++www.youtube.com\idb\4057762524yCt7-%iCt7-%rfe1s2pbo.sqlite
Filesize48KB
MD519fa62f7148c01179fc4f880fe434776
SHA1c01dd45b8b89a8c3f28384874acabc27e71a9b4d
SHA2565fec275e0e704d43817a429e37a48506c130b404ecc46805cd5e3614d4a9b34c
SHA5129136df7cbd0602d3c8abbbd64c480679e000e2a13f0e849fa86112a9b654174753da23312fd28cf780d6aa1357b52bb05cd845842f332a7826edaa827ee6270b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\datareporting\glean\db\data.safe.bin
Filesize182B
MD57d3d11283370585b060d50a12715851a
SHA13a05d9b7daa2d377d95e7a5f3e8e7a8f705938e3
SHA25686bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9
SHA512a185a956e7105ad5a903d5d0e780df9421cf7b84ef1f83f7e9f3ab81bf683b440f23e55df4bbd52d60e89af467b5fc949bf1faa7810c523b98c7c2361fde010e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\datareporting\state.json.tmp
Filesize51B
MD53e32e2cc1ed028dd8ff9b06f50a4707b
SHA1b3910351bd8e13ad1479db699cf6fac6544a5bef
SHA2564a3a666d98e61b5fe06fecac56807137a0fffb4bb71d4c3b16baa8702dde738c
SHA5124585ee9ec04adf138727cd039a9cbe78db6cf2926f6ce92524312a42efd1250100848a919ec4b833f9a013181ce93734575b86eed37f1bf32effa3237eba84db
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\extensions.json.tmp
Filesize40KB
MD5ba6fcddaf37c5ea04afb42f58fb4dab3
SHA1b4abcd8917fe9ebfe5ea649bbe19ace0fc621f0f
SHA25628b9c9d2f4240f4828dbe727d9f03f2dc36f8dc3fed99867d13b7af106973f6d
SHA512fdc1add8c37a9023fb9ceb80800544350a90637fc53352bb3696db48bf52b05d1b112f866436708a3950044354becc81a7940d0e31dfd6160b37eae6f9b79ed8
-
Filesize
5.0MB
MD512ca7a7f456b89b5c221a2990029d0e5
SHA1f7ccf85ea56677d391a81f046cbc19c98015ff56
SHA256ed01b7948d4591fb4f9c3c95b28a74f7a9a1a1595a7d5338fb978996fab1ddbe
SHA512198b2e39ed003e5094523b58a41bfb4b3b9956340a5ddda5f3bd15276089f6032be4ee19a845ce6264889c8019a4b8712a70a058cfd910045db44be6fbbf2bc6
-
Filesize
6KB
MD54bcaa28d0c211dfa03c7877ead10292f
SHA13d4a8916f0a3727d7858840d8089afd609a110d5
SHA2560ea22fe93318abffc1b00d452e2aa6b9ecd7041f58ae672fd2aedbf53d8d731a
SHA512b7ada20ceeabe86679d1be337ca17f1b75f5016aa33f0d6d194d0a20fb81e6f3c3b673a0874fec81cecc9843022579be290771d7958628afe333c9f939b38a44
-
Filesize
7KB
MD5542d374d0b8eb47a372a88dac8d14eb3
SHA166ec3fac2c62bc96967211a63ea9b41da0144717
SHA256b81c294c50dd9af0e2fd776921ff26fcdfe2188eab0018ba49234af497dbb4b3
SHA51230ef510159a6ad11d62b2886a5ad3751d3bb617427d564faa140299ac1e5defaeaebae12bc291bdb8572267cc351995ace1e5916c1679ec3fd3ba019a3a78508
-
Filesize
7KB
MD5196baae542e351b2cfb344f5ccbc875f
SHA19fcf1f1d78182ebecf1d353d7dd7c9b6b5b9411b
SHA2565b15fc1e7113a9add8d5abf3b138708bd5347c4abf8f2af57e424268e813b68c
SHA5120339c9278437404fb671f936a7a37bff248fd53e7067a6bc64818fd7502b5a61409a6be432ccf5909d265e73a0f9ecdd2876b29da4252a09798e503d2c23de56
-
Filesize
517B
MD5c72ef9f3aae7f6220baa426fde39bc25
SHA1f52e3e835d79ee7a1d1b501832e6efd2ec9be5f6
SHA256c5a92f5daccb090bb35df04207c86fc631ca70935c10a1e8a56ce5d41ed81ee3
SHA51246e47575ed21ccd38a3d78e72ee5129027756c1c8cc58a7cdf0421782fccef731c9fdf8bef806847805e0709bbc00d9cfe2e08c9e1a2ed3593f49b651a05813c
-
Filesize
349B
MD5a6aec2134ec9df495e18b458bbc10ecd
SHA1595afe50b029a06e9d351607839f7e4c103fa8b4
SHA256bd22a1716adf6f28e0904d00533a7e8fcdf9713a12aa190ea3ce5d5c186601ff
SHA512188b94d0720c188ac10809a9236afbc9ce8986223d77c6aa368685709575b515bc00d72dd4d71f0d06ac5f323f1265932fbd9887f178dbd4906a76c6bd80977f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionCheckpoints.json.tmp
Filesize122B
MD599601438ae1349b653fcd00278943f90
SHA18958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA25672d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
SHA512ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionCheckpoints.json.tmp
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionCheckpoints.json.tmp
Filesize288B
MD5948a7403e323297c6bb8a5c791b42866
SHA188a555717e8a4a33eccfb7d47a2a4aa31038f9c0
SHA2562fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e
SHA51217e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionCheckpoints.json.tmp
Filesize288B
MD5e08ef355498ae2c73e75f5a7e60eada5
SHA1c98b5ab80782513f6e72d95ab070e1ed7626c576
SHA256d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c
SHA512a0550e83ecd1cf632b4e54bf43744ee9f7c0a8dfcf9a043e018c00d4ca0bba606cfcaaa469b204e7c9dffec1f79b91e16cd4f1c94ff512c45d3dd25b7174e859
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5e30aaaf645dd324bf6ee5329397b57db
SHA13dac629bb577a6608c92ded09be760450d807415
SHA256ec601bf1dde3d4b6035df07dd2675bede2a76a850bf9d03e91d00567ca50fbdc
SHA512772c0faeff5a19e549c05687e9b15bcfe198a024e01b480bfb52930e5afe9d01663ab2cef896042e843163580d794199f48c7b45520ce851dd9ab97dc4eb0022
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionstore-backups\recovery.jsonlz4
Filesize417B
MD590c939e424a13c13e8ae4857dd11048b
SHA1a756063630df3d52e471be3ddf0bfffe6f7163f7
SHA25601753ea120775196fdb1a90c66a2890139d21e9e3a7701ba27314b4ffee1ecbf
SHA5122caaf8c330787a648a386864696e77b325ab13492c98b070b19bb1aa8aa4f1a08dc53138fe526b5b8f358052d79bd2f95fd46f22f5e5bf8360f311bbab43c65c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionstore.jsonlz4
Filesize891B
MD5dc95575b020f6a3d7c22ea1d8d754125
SHA1607dc3cbf0393f6dec14b09b357d7fb813f30d00
SHA256343fec8b273eb200dd85483dc6a900f520cac7d6a28966ab6c7761d96ab0998e
SHA512405cc05ab05aeeaf6c9b9e7bf9be44a1aa22bf01f431e5e1c0e659b82d0319c606239663f352682a22ce2fa0d0d2f97a8c132f349b897e999e7ec8a7c2efba31
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\sessionstore.jsonlz4
Filesize893B
MD5c305d818fc22339c2fd965e48b07cb32
SHA186e9dbde1ecac68d81210a373517c9a37c18baf0
SHA2560ee6428a68a98b65fab382dfb530483d479f3e90cf5727bdcc897c6868aed8b9
SHA5120719f11daca62d9406eb9aa34c2ac1b0d1f5d948363672d570cb59378f8afa6389b74512971ff2a7799eb399046e0e8e3324636200b2021f74e24720b1172871
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize160KB
MD58e56bdd4031dc60386baae4f9a3094fd
SHA110e1bc35411aa92bafdf1efa51b1bc22134b89ed
SHA256b0a75f8f4ab336e058086aef41f27da6613914ecf2fa6c9cacdd0c33664c313f
SHA5125b6fa9d6d5297264c29d4a4e44998cc83fc2a2a8de3584103d0bc133a1393c2ec775a2d8fe68c7d4a732021cfe92cd1dc652f55088523f8e473deac3e59416ef
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hzxwviuu.default-release\webappsstore.sqlite
Filesize96KB
MD55bb5e715625f51470c89c316e7e6a592
SHA1baa51e90123a1686c3a1a0d3cf34705c9dc64e3d
SHA256843df8bd0ee4efedc4c4cb5febe9928815b502380cb74ec836e0976db7e4bc43
SHA512ddf23c8f4a6a2b052462e19f74579ebeb41a5f63677fdbd1e9bedcba3cc318c92efd7746e41b4ec8448ac89603aa87f41b67c87c23d6b74e752c2abf95035523
-
Filesize
1.5MB
MD5e5788b13546156281bf0a4b38bdd0901
SHA17df28d340d7084647921cc25a8c2068bb192bdbb
SHA25626cb6e9f56333682122fafe79dbcdfd51e9f47cc7217dccd29ac6fc33b5598cd
SHA5121f4da167ff2f1d34eeaf76c3003ba5fcabfc7a7da40e73e317aa99c6e1321cdf97e00f4feb9e79e1a72240e0376af0c3becb3d309e5bb0385e5192da17ea77ff
-
Filesize
110B
MD5df8bbd5d1aba282f39d4237bdb0672f1
SHA1703dde200690eebeafc13ceea3f5b1812ed23c48
SHA2567f45f77418cd6c0549352c7544fff1d760ab5d353b0fc4d0d361ff30943249e7
SHA512c9e58dab4b6dc306d1ff8bc49952f69a296c63569b8c9c6663ec5869a1d98388d82c0c8563cfed1ac35ab1464227e3e99a9bed0145c7efd5d77f61376f135a49
-
Filesize
15KB
MD55d06a186d98c91ad9f4078bcfd696ed1
SHA1f73e1a8eab6d68298e9eee53c5ea3702cb7c1976
SHA2569da2a0226c2c99ed6578c347e09c67b1dd30ce9f4b4634b635a73127871e27c5
SHA5128368c7ef298e9fa55b75d8464c8306ba37ce44d0e0dfd65cf5f9e837455917ef33acdad82254a0763efda2940c06dca28ad064e602d17e833a956e9e99aea83a
-
Filesize
374KB
MD5d7dc7f6df11fdba2abb370c3d8c83a0d
SHA13a94167eb1443da240df37cb6b23d2ca3f014b55
SHA256448547436df718b44aaa41005bbb209ad904f2d464a331aa64fd888dbabd808c
SHA512289dda47aed757435c7195348673f8d921006ca4d1b3d4e721a55d3334f4fa60eb9760a61b5184665f4d1f67819fb23b4d7b963b47d659ccf1a784799e12f778
-
Filesize
4.1MB
MD5ba7504e11b2d9ba19c349e44bb1b1de0
SHA104b9162f38444b8fab6da608c8b68aecd633bb43
SHA256ee2de60bff2ed91678a773f1469e23a17a18f0afde13050c9c5042e44edbc3e5
SHA512d80668d716526b8f620912f772ab1ac1d89a17cb1d2f3137e06ad83a4e5856c3ee957f4fa314020fb83041f856ba493ea804b7a0b84d40df2db95dcf54350e48
-
Filesize
415KB
MD589bf9afab0c94ad8d3a327db1dbfaf89
SHA16f245f5141c1d48c481d968aaebb5bf2f9a8d715
SHA2565aebd890001e8e1291f8e74b70b9bbf5e0525439688792af58a70a13113ca89f
SHA5124fbf8f8d4cbb73962255900f43ad90d37a10b106c56b4feb420a3375d06b06e53f6ca0fc7c65410149284a57e5895b5570c78a78d04f9da50abe4e906bb5dfc3
-
Filesize
390KB
MD569bdfb4fd2075bc65fd674a02f6323d0
SHA189c48ae169e97788b6dbf8af59817a68e64082b8
SHA25621cd4819ade6a9292b87fc06439916aad02fd505f9ec45d9099751d1f2de3057
SHA51201ce2e65a2f4c4f27155122609e484a3d33668628a445d5c56ce64b2b84935ceb4ac42b07b0387e060d8a86728b69244dffe946055f87bae6e9da9458309a90d
-
Filesize
405KB
MD5388c78d864348739039fcb105007e03d
SHA16624754ea9a6b691a1a8f0acaa0ab899cae339fa
SHA2568236ee03ce163ee55d90d307a5e7d553e8fe243bc54229cfa96e016079ad6846
SHA5126b8fc761215046c7d6cf1bad1588a3ecb112a5628254435a56521c9f938a3cb5d23b997034b77c2426ebd361bfbd6d679d21491b6923ce3a031729cf38f6fd04
-
Filesize
257KB
MD554a2fe01b7a556c319c6b66abc7ce484
SHA1ba6bb860443ef5731489554a34d4635abef2a42f
SHA2560f4850944224a0b672a0f4e19cadb081aaa00739a704a468556522018d474d92
SHA512504dc027e144c57f021bc758692410fc2d5161af5613b86592fa6005e95dbc5f74b672009e01c622c6faed87e10bb4bb3a106e65055385b5fd263619318d33b5
-
Filesize
304KB
MD57f8de60146b33f485acc8fb88083371b
SHA12b143661af95362fef4c5f05b0630fe4dad0f421
SHA256ce405c7e6320e2132e9b5513a29bfdb97e061464b852a0ebf98b5efbc97f69bc
SHA5125b55f1b92e51cec46b169b7675538b6c335ec31ffffd3fd3a0215387e949804de506b0421f75cad57b7ea40b787c8278ed0fa2d2d3f4dace44c36220da0a7de1
-
Filesize
413KB
MD50128b103713cb1c80af4855a8a54343c
SHA1703b846d515b4031790cc1584f1a80172be283f6
SHA256863937c45f07135dc9c63df21d729d5b2435fed73c4ebce508725e2eabfa74a6
SHA512115f97aa890dab2e9fb5eae9ee49486b2a2766281724fc48fc18f72255cf9da9c2a0d61b92655d4a5707d57ce462785c53ef149c34d565e385318b70f702dad3
-
Filesize
218KB
MD51bd518e092c3d8b6f11981cb20064fc3
SHA103745d278ea80559907c3254ac522e6b09b5101a
SHA256b8c23aaa473444c6fdff07f3b404e58f516e31c2ec71fb500a5aefc05dab716b
SHA51225a7159bfc5717012b50295440c1c22c73a0362ce1645535e457053ed461d2b85dc79711f4671409282359e39844af71cee2ef6117c87d4a15ffd46393741b1a
-
Filesize
234KB
MD5e14b61515ab4c5736496cb80e3c1a642
SHA1574a083529a404c397553f0a4021dfe3b67c188e
SHA25673f252b69bd1e5b2d4d471c39a790ecb4a633db5d757ec26ed3c764e9b618744
SHA51256c0e6bf60a36e626e81295e5f7d079f6dae68926d8ee1708e814914b2779ec854ae57cbe1961ee69397f65556f740b56ef36e364c71335012d94eca23822ac6
-
Filesize
366KB
MD5f015d2679818c07ad37fae89fe581594
SHA1fb6fda5f38b63be51854f958385d195f683ea376
SHA25633b504db198302b5ba57ed12b05800bc7173e929976a26f155fc5c4de4d6d56a
SHA512a8eb759b0ef4ce9da62b553b9b39160de19031f5c5f8ae647cb25f3fb043cd8de170218a06d73cf81b3e8986f37284f97400e1639bd7b97d5868aa0c99cb3e37
-
Filesize
187KB
MD5bc9babc35a9b31c03c0cd296a103eb24
SHA183c49652b2a664b664edf58a7e9d6298276fd4e8
SHA2566a167768250783bae86e02610a17a24884b9cf20a5abd3c370c8df806c7536cc
SHA5122d37c541d52cc920652a21a6f39dcdad6e89bf0212559c1091af85a29bc788c5611b4ca2b5eebdb8cb0383bf54bbc550915c9a95c9e948db81d61bad75564e02
-
Filesize
179KB
MD5f08eb686446453a8d35e6b175c6e8129
SHA1b4359a4030620937417f900bd0731118c7ec2031
SHA256e47500fe715e4d7425b9ce1f8a83b76719876e0cba8ac3dcc78e9b6ec297dfc8
SHA512d46fb56a12f667e4f431db362551330ad182b5094fdc54b6f4b8b1938d654a5e1e3ef8acfdeaafd0bb62ef3f3bd8e9c11020298180ca201fae9641bf5991a435
-
Filesize
171KB
MD5b94def3d4b005468d5fc8b462d90ae78
SHA1d52866eecdd196cf83ff3be59ab51b4a4b04dc52
SHA256a3cbb512cc63e40e91a5e632594a9d96039deefa3462c111b17e8996849877e3
SHA51218a094f5db7a119de12f7b8cd81e32e99382518993d9bfec4e91b727610e5be3148af850eadd23ad91b47012b615dde57a68f338fc3b0ce9d6f5dc38d8713015
-
Filesize
156KB
MD579d6f7af14b063657f1b84af4a09944a
SHA1c656da3d1e7de30eab56442e85d75b4cbd03fcbe
SHA25647fdbcdf017fe42c8ee348c81bd8b1556369325a4b6aa67d6710d7682819b36c
SHA5129648d6ba2cd913d1304e8f4d5ad14a531e0b67d9c5c1044588b1efe6e51c2b30eaffeb63fb8ec60a04619078057b8115926f8052abe2e368c682adee2d83df41
-
Filesize
358KB
MD556c0efc46150830002424df9091b5b6f
SHA1d4f549a5daa6294c897acdaefd1a5d3362e4ca63
SHA256015699141cf3a97ae9c67a805c01a76b76953229aea1468b29f3d5fccd0f5220
SHA512a9b6b0d94e779909abce24d7ae702eb9b21ab8ae4d7a76cd9298bfb55e3c2937f99854f211bd1261ca9a5f6e94735ef9163829abd7ba060ad7d7ddb14b479d08
-
Filesize
288KB
MD5b7c4c26960d0f49bbe649fa6b765bc26
SHA1b08442c11452ac19bd96c01f7c374eaea41dc678
SHA2561691d333c6dfb8deda37bf565020436442709326648bcc3be8df94b358dc4ef0
SHA5125324741e87381e7935c4d4a3d4d6cd219c10c79555d85f0ee7ffce8d1a863d9fba957be295198bc0ce1d56b024cbe2334bb4924f3ea8fffe4d5fbb6a237ff22c
-
Filesize
351KB
MD5d9131a849e5c1e756de6ea08a48b21c6
SHA13e035b4a75d69bb59aaab44f26a9f7c5cb8f902b
SHA256e990ee0fec2990fc92a11144c24c641fc44dda0fbb3c0a1ce5a233e4ecb5cff4
SHA512a9432854bc88a66523c5e06a1b076cf05568d82a48402c16396e9106f7c4c029af4dfd5958018cfdb4470f44b7410465f19cbc9cffcf8054c32de605596941b7
-
Filesize
226KB
MD5c582c13cf76977029f4c6150d990a5f2
SHA1816c08e90ec9f71d78821f281a7d6933bbe30a2e
SHA25620018edff0b61d9af1101de23463fe3b26387354dad7c34d532fac3820be6a6f
SHA5120a6e9cc1b159114589fe9a86d6b3a40d6521c59038fb0beeb350db146f1ccc991eecd469f4d85c43ca42cf148aa3709328e1493af9ebf8223fd603a012a47ac1
-
Filesize
148KB
MD5f6581fd53773c7d6ecb1136dd6a96aa3
SHA166b4da796e8e4246d70d4c14be48009cd5c34654
SHA2565200db89fdfcd5666e8d6e97b249164f26043789c3b3adb184f335e117a16eef
SHA512638e2e2f582f03129ea69e8f802a43b699039489a48534f70cff4329244bb7dd0f24021a412e358998c80b1bef03effd1ed81052febb8cacae4b4674294f35f7
-
Filesize
319KB
MD5841ecc834fc7a0877c2dbdf6dbd6b0a7
SHA19d35cf16aa52f79a4a08fcd7fd9585445387af18
SHA25667323171eae091099a26cf041634411d546e9ea594512875c85381919621b166
SHA51259b0460dccefd7d6f3c5d3d2529eb3cedfc9701b39427c8931eb7503997d6baec4cb209d80bb5f4f62b623b9c0d4241b735354b3da78ccc56ece7fe0ba42d58f
-
Filesize
280KB
MD5fad5ff1fc91b51fbeb03bea74a5ad012
SHA144248a052dbb4dbb451d8118a9cdd7fa38c3d079
SHA256ad65831ca34c7fedc532b0135314679bfdf75fbfcd63ffdbbd4c8fd364bb4a16
SHA5128c43bc4a17b5f14527c0e64f6c37f4c479142a30fcd9461573c05e3fe6f48e4b98e400d3bfecea1b9240c580f608daf2df56d2ce53b656001d9008a25d3b6412
-
Filesize
195KB
MD5dfb7797f2228942032ddf11d77c8961c
SHA11f5c85e6686d60a8ff1eddb87b7e2e0243c1b076
SHA256936cf4fec212573a5e32fb24e4fc6cabeec87eb52c05083212516bcfca0da644
SHA51235626afef83d972344f9d245d6bbd83f47a842c90a1056f18d5d9617f502191ccfb807869a3ecd54891d62f6ab75578ff5cb9145faeb2ccda511d5a1a37d0333
-
Filesize
210KB
MD57f41a8eaa8877950b4c159ce2be0ef69
SHA1774dd34d9969f9916b291bb2e6b13a3760d499f2
SHA256eaab1dd9e0b003920ac5d4879f6c5b4b4da755fbb29f89d00545ea29a78c23b0
SHA512d132e0038443a8d1b2ed58a3900331f9d5c33b102fa7358dbd645c59297e6693674aea962fbd5799d027d91fa63735759f2219526fe2fdda4047ef8db3963f65
-
Filesize
273KB
MD53a8712eec17c6efda0e13fd996f0b6fa
SHA11281dbd59f366878cf507f2ed07b13c81e09a612
SHA2569f13b78fb16d294bf9dd1f0271b569550fad1f64df048bdfbd39fea905509b17
SHA51239c7aadcedbdd7b7b12e859c2e4c4d9e0d4fd9fe66b5347781d5f38caca36090037b7b44a78b3125f4ae311b9c1d9dd294920b7eb0d5e51b61ca7dfb9ae979e0
-
Filesize
241KB
MD552cdb4300040c498c5de1c072dbf58b5
SHA182aaa6b6cc90245d2f8c32c8fc60ef04203d2df1
SHA256b465b62dbce22746f4fdad6b2d8a01e2a6f65f0a4a243fe53f7c129b905a0fdc
SHA512a643a90af371bdc8dad6118d73d3970583fa730bfb3ca0636c047c75b09f2c04dd8d6d9f114447a861d21613e47866d2cdd010fb2e716937246822583a899be5
-
Filesize
202KB
MD5c977289c1abf571487d43ea50b6095f8
SHA1cbf6681ea2129377183fc932a8f56881cd3effe6
SHA2564847ed171911aeba20e677d6eb46b978479b14d8079a9574ddcee2393e005073
SHA512be83c2b30fbfb07fb4f1593566438e7c378a4c9682c2f1162ec474ca3b97d994d98342bad7805eb0e4f256624a32cf22c136a38225a41b87e45e2c076b55a458
-
Filesize
10.0MB
MD58b0bd9f8388838ba8848b97720e5e4d0
SHA10bfb9c430c10019302ed71fb99ecdcb367382005
SHA256fe2919fe03b687d346a33162fff053b44213d9c3e06b12abf43742955225cf12
SHA512c2ca1cc8df169b2734ddb5e08876d822279fc525e4c1cc2768f035c5952aeb4d2abecc5c8d4aa46ed78801104d366f753184146454cfe26749d1d894e3c0bbac
-
Filesize
498KB
MD54bcbf97b45320fd1995037b5c2fda8ba
SHA1e5d82af83ef9875c435942d34f79d92a62a65672
SHA2568ea62cf58512d2544c0f66fbf28e12c7a8344d4a08e8256c968a35de58ccc513
SHA512c4ae95de3e086442b19c01b18cb8e9ee12aecff5f2a2f3b96c55f1d95ebe871967f7445e364078209d3a0947805aea492459d2586bf9ab453e11d0cc90f76f26
-
Filesize
163KB
MD5f1807ffd8d273b93c03960df751e2250
SHA1196dfa35ca79857b398fb2b8c8ab274d22bf3a3a
SHA256676d5475e986661d4e88f68f7afb811e10863a9b4b7e0b789db7d844d12dd901
SHA512b566613a6573057e2e5657ed65ce5edaa509a3b70bd03a9efec30f161b026fbb4f2c20a4370c05ab6d1ba4b233cfb603e7d19b5c211caa74180d02f44337fcf5
-
Filesize
382KB
MD591a4ea39219fa26f1a051c7dcdbbf027
SHA162aab101360264d755404b50d8c8ebd61483c88f
SHA25602d24d139aa6b28eafa3a3dbca4017dbfd5fffef8b335d7d6f63f81c04c9b7d4
SHA51294be1bae02fdd6f417f3bccf6e13daef90d60b21ded71ee37be08f6a02433d3dfc01b9c32691914bcd7aa3e1c27c87e65ac1e6e29aba096ac80c6d02ab878370
-
Filesize
312KB
MD5d31d3be76572fb7dbd03c47d9eaa478d
SHA11a339efed48e4206d5487e7d253602acbc57f398
SHA25615cd93c57eb0019be1e7dff7a63662081655e47673af7b98c42754bdb92da274
SHA51283bd230999aa55af1b9c23451cb053abe75ff4d3ae837f0ec8e791a0ee4c1852cd7612d3e47230435c03b20d9689c8da6ddb0c50d5b32afaa39dc28c24a538c2
-
Filesize
335KB
MD54fbe75b9c8e2b3b3179d801dd078d1ef
SHA108170f559e91e7fc008ff883a8ae4afd244378bc
SHA256baa8fa27f0e95f40001742d5f264b0d917c6b5478b624c7b13bea6830d1c303f
SHA5127842adb42686ed707985bd2ae27ceee653586d60d91927d38bdceb1eb7fcc7f9f52c04f5348ebc629ab6fe5ad4d87c83b19eca521c2b7ecad136524ba792a44a
-
Filesize
327KB
MD544e48f3f79263569ac5aee5270f66597
SHA1969b90786fa7e2a5f29126b38e088b4fc5a0d821
SHA25658145bdc0c102ca2d5696d1b3508656e2ec6939bb379b41a26ea978669bd97c0
SHA5128c21b55c2caca19aaba3648c77d93cadf74ef62709ad6857cb3d652c5c577e235b28fb73f0a6830f24704b0e1443170e2fb7ef82f50f8d817351d6cd09757fcf
-
Filesize
265KB
MD520ccb871cb88d5a376f176633898c269
SHA1798718a95b4980f7b44e1b2aa5e28dddb9416019
SHA25631d0cb7bc063b6992b8e8500812d88dd80633e8bb8f2f51eda16d45b97b5c1c8
SHA5124d5fab6a1ab2cf24901e6541bd271e4548ea044075a20288f029fca2bae61fe7b83b69e02306f9cdf6ad4abfbec7e0de2b4b25cbb58e0a0ab297c45c0dece922
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
148KB
MD5be0b6bea2e4e12bf5d966c6f74fa79b5
SHA18468ec23f0a30065eee6913bf8eba62dd79651ec
SHA2566bac226fb3b530c6d4b409dd1858e0b53735abb5344779b6dfe8859658b2e164
SHA512dddb9689ad4910cc6c40f5f343bd661bae23b986156f2a56ab32832ddb727af5c767c9f21f94eec3986023bae9a4f10f8d24a9af44fa6e8e7e8610d7b686867b
-
Filesize
209KB
MD50e91605ee2395145d077adb643609085
SHA1303263aa6889013ce889bd4ea0324acdf35f29f2
SHA2565472237b0947d129ab6ad89b71d8e007fd5c4624e97af28cd342919ba0d5f87b
SHA5123712c3645be47db804f08ef0f44465d0545cd0d435b4e6310c39966ccb85a801645adb98781b548472b2dfd532dd79520bf3ff98042a5457349f2380b52b45be
-
Filesize
269KB
MD54367508c0a612115c8d15c92b6ccec0c
SHA1cf19b8fd08d65af94f519e71b7976d3699ef1cd5
SHA256a7d7b98449549710b359dcacb41642e26e9d79523fb1507860ba2ed4b314ef89
SHA512291a111cdd47182421786dec45a9cf08d10fdf2328afff60920f16eeaf8ee84e0c4c6fb2c04ab215e28473e5e4adca4ecfc80cba277dcd351797838e410d737c
-
Filesize
87KB
MD546790e2748ddb98e3d6115a5f0360ed7
SHA1d041d6aa45a7fd2433b46560377559e04b92f7b6
SHA25676cba690283ad7098dcab60a090fa20066e1ec0c952ce0e73dbd3f36411ef39e
SHA512c1964abf5ca969a2e3e0cc7923766db5dfa999a849d54119e53730686a2b5d3e5cd28d3c375ba012c3d2c29677aa336ac6a48aaa45b466975caf045ba9dd895f
-
Filesize
885KB
MD51f0af45ebb41a281e1842cf13ec0a936
SHA1ed725de3bfb61f9614d76497ce88488925502977
SHA25618c9929344a096d80a051b2513c1c91ca89ba22c9e8d24240faf1566767a9e66
SHA5123c414d6ea6f929d9710ffb9a8dbfa737b36ded9b2cdf8260d6a8a9224ffb005e1dc090d331b9f69b9c7c8871570f437288fcc3c8b51dd619df9975d374085c8c
-
Filesize
93KB
MD5186694813c3d5e33202a1a72c5079cc3
SHA190a9c2bf6419be6f46999e137c2149feca62cd13
SHA256fb13d67c05d0e3c693701d782a55bc002ab62e972e4f018bd6b1717493bf1ae2
SHA51257bf8ef4bdc08bcd7a83f82d14556710a2ef0cc7ef63366c48b144002a5f70cd58a130011cce648dcb3e9f62eafd6b188aa908b3b8f324448fb38567e499383b
-
Filesize
80KB
MD5393da89078925f78e19445882c37fc59
SHA11313f4e6c62670f1b10aaec77c105be275f50121
SHA256bab5c035abecdb9e89b93dc5cc688b5c3e5c6aec4000e466595ee3ebb3342ca4
SHA512aea5690cc1e6decedfb963c728b880ddcccc3d15b190943a890c38d41057d3511afff2e6298c6042ad2d862abb13e95992406511356bc58bad82754954f321c0
-
Filesize
418KB
MD567f23a38c85856e8a20e815c548cd424
SHA116e8959c52f983e83f688f4cce3487364b1ffd10
SHA256f3c935cac911d9024c7797e8ffe4cce7d28154b236ad3e182f9efb85cd5a0a40
SHA51241fc1b4e2f47d5705861ee726c8d5d7b42191e7d586b370981da268414f207f6dea00a59dc53012cf6510c44651fec4a3a33bf69e501d85fd2efd66517e4169d
-
Filesize
225KB
MD5d711da8a6487aea301e05003f327879f
SHA1548d3779ed3ab7309328f174bfb18d7768d27747
SHA2563d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681
-
Filesize
97KB
MD5d36a56e88a78b4d3c7ee1f4f804e17d6
SHA1a520426523be085ec67291241f4219ab13f4d4b8
SHA2568178c4a2b71ed1d6887df8e0ee4a6613f96a518c43d27b38dbcf8a3d447a38e5
SHA512def633644549d1bc92b28e8e577ad48391f774551091060b393283940ea53b22a612b3d8648640ff3bb436d36ac2edd704cfd3768a7014b01fb8fd438c51edca
-
Filesize
81KB
MD5fccdc45ca17e5180b40efc28052bac39
SHA1cecb5a7e8807e619956183897a64930ce56294d6
SHA2564ab37b0f9c5fe3505e1ecfe0764aaa04838cf81f9e0a402425e057f7a251e621
SHA51267a9cd2066155b35a4b11e7917c2b6dd1d39828bfbe2972b22eea79c1891fd142f50273dde0cbf0a500259fb468f7636db05131a70b3c54a143f945d037da1ce
-
Filesize
155KB
MD5279d65e1b81b6e5749aea3eddf09347c
SHA1d7e0bcb107896f2117173465a060499facf2f4ca
SHA2568b1da2813a8d71321fb5d6290178257405f35a1968d7db977a089698eb9cbcbd
SHA512120bd400ccd966c5e35bd60899be8fb9252c41f26e0de5ad3209ba930576fc48decb6802b7d08a6f7e09edb007cc0db0beec8f21339e7b1bb04a48dd73fe3380
-
Filesize
146KB
MD58e9a1d827a7cabdced5687202df4bafe
SHA16ae0a9e5ca17b5339bdc43fe590469f3b7f59051
SHA256007709634e33599bc1d98ee0fd5c7e00816580e7e3c2705b07ec55a4c8acc499
SHA512b7b3f1f0c58e52900ed0f16398fbc99a0bdf30a485d27e8a162786103eae0956d7417045b990d4de19be343aaa4e63fb07d91477f183584724f23de3695ee39b
-
Filesize
4KB
MD59eb0320dfbf2bd541e6a55c01ddc9f20
SHA1eb282a66d29594346531b1ff886d455e1dcd6d99
SHA2569095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA5129ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
-
Filesize
5KB
MD5d5070cb3387a0a22b7046ae5ab53f371
SHA1bc9da146a42bbf9496de059ac576869004702a97
SHA25681a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
SHA5128fcf621fb9ce74725c3712e06e5b37b619145078491e828c6069e153359de3bd5486663b1fa6f3bcf1c994d5c556b9964ea1a1355100a634a6c700ef37d381e3
-
Filesize
197KB
MD54356ee50f0b1a878e270614780ddf095
SHA1b5c0915f023b2e4ed3e122322abc40c4437909af
SHA25641a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
-
Filesize
11KB
MD5302563a713b142ee41b59e3eeac53a90
SHA11340e90cc3c6c5fc19a7feb61d7779f4a4f0fdb5
SHA25683ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
SHA512c9d4dfc20802bb542178300d1044bb94b35593b834ab0b50875a32953f890e48da456199128500e2c1fee26eaaf8c2c4fcaffb308b37914215f900cdd5c4cbc8
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2